The short answer
Chain_03, subtitled BleedWide, is the second of Hacker Blueprint's free OSCP®-style Active Directory chains and the one to run once Chain_01 feels comfortable. It has the same shape as Chain_01: two Windows clients and a domain controller that form a small domain on your own computer, started from a single domain user's name and password, with full control of the domain as the goal.
The labs page sums it up as expanding domain access through coordinated AD attacks and spraying. Where Chain_01 builds the foundation, Chain_03 widens it: more enumeration to read, more credential attacks to chain together, and more to crack.
The lab is free, and so is the full 51-minute walkthrough further down this page. We also use this walkthrough in our OSCP+ Active Directory methodology guide.
The Chain_03 walkthrough
The full walkthrough is free on YouTube and runs 51 minutes. The chapters below jump to each stage. If you've already watched it in our AD methodology guide, run Chain_03 anyway as a speed drill against the 4-hour timer.
What Chain_03 trains
- LDAP and domain enumeration
- collecting and reading BloodHound data
- Kerberos attacks such as roasting
- Windows privilege escalation to SYSTEM
- dumping hashes and cracking them offline
- password reuse and pass-the-hash to move between machines
The walkthrough closes on a lesson worth taking into the exam: BloodHound maps domain-wide attack paths reliably, but a user's groups in that graph won't always tell you where that user can actually sign in. So test every credential on every protocol of every host, and let the results decide where you go next.
What you need, and how to download it
Chain_03 has a GET IT FREE button on the labs page, and it sets up the same way as Chain_01: import the three OVA files into VirtualBox and put them on one internal network. The setup guide and video cover the details.
| You need | Details |
|---|---|
| Memory | 8 GB of RAM minimum, 16 GB or more recommended |
| Computer | A Windows or Linux PC with an Intel or AMD processor, or an older Intel Mac |
| Won't run on | Apple Silicon Macs (M1 and newer) or Snapdragon Windows laptops |
| Hypervisor | VirtualBox |
Take a snapshot of all three machines before you start, so you can restore a clean domain for the redo. Everything runs offline once downloaded.
Add your Kali attack machine and you're running four VMs at once. If you're near the 8 GB minimum, read how much RAM and CPU a home AD lab needs first. On an Apple Silicon Mac, the chain won't run, so see what works on a Mac instead.
How to run Chain_03 like the exam
Chain_03 is where you prove the methodology from Chain_01 holds up when there's more going on. Run it the same way:
- Go in blind from your snapshot, walkthrough closed.
- Set a 4-hour timer, the AD-set budget, and note where you are when it rings.
- Collect BloodHound data early and read it properly: who the domain admins are, and what your current user can reach.
- Start long cracking jobs early and keep enumerating other machines while they run, so you're never sitting idle.
- Run more than one privilege-escalation check on every machine you land on, and confirm each finding by hand before you trust it.
The full six-step practice routine, including the week-later redo, is in our free OSCP labs guide.
Where to open the walkthrough when you're stuck
Use the chapter links above, and stop the video as soon as a new credential or login appears:
- Before your first shell? Open Initial domain enumeration (3:40). You've likely not read everything your starting user can already see.
- Shell but no admin rights? Open Privilege escalation to SYSTEM (16:05), then run the check by hand on your own box.
- Admin on a client but no new user to work with? Open Hash dumping and cracking (21:18). The next move is usually a credential you can pull and crack from the machine you own.
- Further along and stuck? Open Lateral movement (28:38).
Watch one step, then close the video and carry on alone.
For more chains worked part by part, see our OSCP Practice Labs playlist. Our Hacking Active Directory playlist goes deeper on BloodHound, Kerberoasting and lateral movement.
Turn your Chain_03 run into report practice
By the time you reach the domain controller, Chain_03 has handed you more credentials and access than you can keep in your head. That makes it a good OSCP-style lab for practicing the notes an exam report is built from. Keep a page per machine and log as you go:
- Each credential, where it came from, and every host and protocol you tried it on, with the result. That's the habit the walkthrough's closing lesson is about.
- Each command that moved you forward, with its output, in order, so you could repeat the step from your notes alone.
- A screenshot whenever you take over a machine, with that machine's IP address in the same frame.
- Where you stood when the 4-hour timer rang, so the week-later redo has a baseline to beat.
When you're done, open the walkthrough and compare it with your notes. Any step the video shows that your notes skip is a gap in your methodology or in your write-up. To turn the notes into a full report, our OSCP report template guide shows how to set one up with a section for each machine.
FAQ
Is Chain_03 free?
Yes. The Chain_03 lab and its full 51-minute walkthrough are both free. Download the lab from the labs page.
Should I do Chain_01 or Chain_03 first?
Start with Chain_01, First Contact. It builds the methodology Chain_03 assumes you have. Move to Chain_03 once you can finish Chain_01 inside 4 hours without the walkthrough.
What makes Chain_03 harder than Chain_01?
There's more to enumerate and more to chain together, with Kerberos attacks and offline cracking playing a bigger part. The core habit is the same: collect every credential and test it everywhere.
How long does Chain_03 take?
Give your first blind attempt a 4-hour timer, the same budget OffSec suggests for the exam's AD set. The walkthrough runs 51 minutes straight through, and a redo a week later without it shows whether the methodology has stuck.
Do I need the paid chains after Chain_03?
Not to keep practicing the format, since Chain_01 and Chain_03 are both free. When you want to target a specific weak spot, such as pivoting, the paid chains on the labs page each focus on different skills. Our free OSCP labs guide explains how they fit in.
How close is Chain_03 to the OSCP+ AD set?
It shares the format: three machines forming a domain, started from one domain login. It's our own build with no exam content, so it trains the methodology, not specific exam machines.
After Chain_03
Once you can finish Chain_03 inside 4 hours on your own, you've covered both free chains. The free OSCP labs guide shows where the paid chains go next, including Chain_07, whose full walkthrough is also free. To see where AD practice sits in a full study plan, read the OSCP+ roadmap.
One of our students, noah Nguy, wrote: "I passed OSCP today! There are a ton of techniques … Your notes also very helpful." (More reviews)
Try our 30+ hour course for OSCP prep with a free trial, or download this free AD chain.
Stuck on the chain? Ask in the Hacker Blueprint Discord.
Sources
- OffSec: OSCP+ Exam Guide (AD set of three machines, username and password provided at the start)
- OffSec: OSCP+ Exam with AD Preparation (4-hour timer for the AD set, enumerating the domain again as each new user, redoing AD sets without notes)
- Hacker Blueprint: Hacking Active Directory Chains Methodology (Full Guide!) (YouTube, November 14, 2025; the Chain_03 walkthrough)
