Chain_01, First Contact: A Free OSCP-Style Active Directory Lab

    First Contact is the free Active Directory chain we tell everyone to start with. Here's what it trains, how to run it on a 4-hour timer like the OSCP+ (OSCP Plus) AD set, and the full walkthrough.

    By Hacker Blueprint··Updated ·7 min read

    The short answer

    Chain_01, subtitled First Contact, is the first of Hacker Blueprint's free OSCP®-style Active Directory chains and the one we tell everyone to start with. It's a small Active Directory domain you download and run on your own computer: two Windows clients and a domain controller. You begin with one ordinary domain user's name and password, and the goal is full control of the domain.

    That starting point, a valid domain login and nothing more, is the same assumed-breach setup as the Active Directory set on the OSCP+™ (OSCP Plus) exam. Standalone practice boxes are everywhere. A free three-machine domain you attack from a normal user account is rare, which is why we built the chains.

    The lab is free, and so is the full 49-minute walkthrough further down this page.

    The Chain_01 walkthrough

    Here's the full walkthrough. It's free on YouTube, runs 49 minutes, and the chapters below jump the video to each stage. Watch it as a video lesson, or save it for when you're stuck on your own attempt, which is the better way to use it.

    What Chain_01 trains

    The labs page describes Chain_01 as building a foundation for attacking Active Directory, and that's the right way to think about it. By the end you'll have practiced:

    • mapping the hosts, ports and services in a domain
    • enumerating domain users and SMB shares
    • reading a domain the way BloodHound shows it
    • password spraying and reusing credentials across machines
    • cracking captured hashes offline
    • Windows privilege escalation and pass-the-hash
    • collecting every credential a machine holds once you're admin on it

    The lesson that ties it together, and the one the walkthrough keeps returning to, is that most movement through a domain comes down to collecting every credential you can and testing each one everywhere it might work.

    How Chain_01 compares with the exam's AD set

    OffSec's PEN-200 page describes the exam's Active Directory set as a "simulated breach scenario across 3 machines." Chain_01 is an OSCP-style lab we built from scratch in that publicly documented format, so the shape matches and every machine in it is ours:

    Detail OSCP+ AD set Chain_01
    Machines Three, forming one domain Two Windows clients and a domain controller
    You start with A domain username and password from OffSec One ordinary domain user's name and password
    Time budget About 4 hours, as OffSec's AD prep guide suggests Your own 4-hour timer
    Where it runs OffSec's network, over a VPN Your own computer, fully offline
    Walkthrough None Free, 49 minutes, for after your attempt

    Two things change on exam day. The AD set shares the 24-hour exam with three standalone machines, so finishing a chain is only half the goal, and finishing it inside your 4-hour timer is the other half. And there's no chapter list to open, so your blind run is the one that tells you where you stand.

    What you need, and how to download it

    Chain_01 has a GET IT FREE button on the labs page. Download the three VMs, import the OVA files into VirtualBox, and put all three on the same internal network. A short setup guide and a setup video walk you through it.

    You need Details
    Memory 8 GB of RAM minimum, 16 GB or more recommended
    Computer A Windows or Linux PC with an Intel or AMD processor, or an older Intel Mac
    Won't run on Apple Silicon Macs (M1 and newer) or Snapdragon Windows laptops
    Hypervisor VirtualBox

    Before your first attempt, take a VirtualBox snapshot of all three machines. You'll want a clean domain to redo the chain later. The whole lab runs offline once downloaded, so you can reset and replay it as many times as you like.

    With your Kali attack machine running too, that's four VMs on one computer. Our OSCP lab requirements guide shows how far 8 GB stretches and what to do if your PC falls short. On an Apple Silicon Mac, our guide to OSCP prep on a Mac covers other ways to practice. New to virtual machines? Our free academy has a beginner path on VMs and Linux.

    How to run Chain_01 like the exam

    A chain only trains you for the exam if you treat it like the exam, and Chain_01 is where you build the methodology you'll lean on for every chain after it. So the first run matters most:

    1. Go in blind. Start from your snapshot, keep the walkthrough closed, and see how far your own methodology takes you.
    2. Set a 4-hour timer. That's what OffSec suggests for the whole AD set on exam day. When it rings, write down where you got to. That's your baseline.
    3. Take notes and screenshots as if you'll write the report. Log every credential and where it works, and capture each machine you take over with its IP address in the same frame, the way the exam requires.
    4. Only then open the video, at the chapter that matches where you stopped. Watch until the instructor earns the next credential or new access, then pause and carry on alone.

    The full six-step routine, including the week-later redo that tells you the methodology has stuck, is in our free OSCP labs guide. For the enumeration loop to run on every new machine, see our OSCP+ Active Directory methodology.

    Where to open the walkthrough when you're stuck

    Use the chapter links above, and stop the video the moment a new credential or login appears:

    • No foothold yet? Open User and credential discovery (5:09). The way in is almost always a user or service you haven't enumerated yet.
    • Stuck with your first shell? Open Credential dumping and reuse (14:08). The machine you're on is probably holding credentials you haven't collected.
    • Short of the domain controller? Open Hash dumping (25:07). A credential you already have likely works somewhere you haven't tried it.

    In every case, watch one step, then close the video and go back to the lab. The step you missed is the thing you're training.

    If a whole topic is new to you, our Hacking Active Directory playlist teaches it from the basics, with BloodHound, Kerberoasting, certificate attacks and lateral movement.

    FAQ

    Is Chain_01 free?

    Yes. Both the Chain_01 lab and its full walkthrough are free. Download the lab from the labs page and watch the walkthrough on this page or on YouTube.

    Is Chain_01 good for beginners?

    Yes. It's the chain we tell people to start with, and the labs page calls it beginner-friendly. If it still feels out of reach, build the theory first with our free 2-hour OSCP course, then come back.

    Do I need to know Active Directory before Chain_01?

    Not deeply. The labs page describes Chain_01 as building a foundation for attacking Active Directory, so it's where AD practice starts. If terms like domain controller, Kerberos or SMB share are new to you, watch our free Hacking Active Directory Course for Beginners on YouTube first.

    How long does Chain_01 take?

    Give your first blind attempt a 4-hour timer, the same budget OffSec suggests for the exam's AD set. The walkthrough itself is 49 minutes if you watch it straight through.

    What do I do after Chain_01?

    Once you can finish it inside 4 hours with no help, move to Chain_03, BleedWide, the second free chain. It keeps the same shape and leans more on Kerberos attacks and offline cracking.

    How close is Chain_01 to the OSCP+ exam?

    It shares the exam's shape: three machines that form a domain, started from a single domain login. It's our own build with no exam content, so treat it as practice for the format and your methodology, not a preview of exam machines.

    Start Chain_01

    Download Chain_01 from the labs page, snapshot all three machines, set a 4-hour timer and go in blind. Keep the walkthrough closed until you've stopped, then redo the chain a week later without it.

    One of our students, Bigmo, wrote: "I've gone through plenty of training material before as I pivot from Telecommunications to Offensive Security, nothing comes close to this in preparation for OSCP. AD Chains are a gem, worth every penny." (More reviews)

    Try our 30+ hour course for OSCP prep with a free trial, or start with this free AD chain.

    Stuck on the chain? Ask in the Hacker Blueprint Discord.

    Sources

    Keep reading

    Hacker Blueprint

    Hands-on certification prep, trusted by certified hackers around the world.

    Want new labs and discount codes first?

    We'll email you when a new lab drops or a sale goes live.

    Your email is safe with us. We don't spam.

    © 2026 Hacker Blueprint. All rights reserved.

    Built for hackers, by hackers.

    OSCP® and OSCP+™ are trademarks of OffSec. Hacker Blueprint is an independent training provider and is not affiliated with, endorsed by, or sponsored by OffSec. All content is our own original material and contains no OffSec course, lab, or exam content. Individual results vary: passing any exam depends on your own study and practice. * Lifetime access and lifetime updates run for as long as Hacker Blueprint operates, with no renewal and no extra charge.