Free OSCP Labs: Practice Active Directory Chains Like the Exam

The short answer

Hacker Blueprint's free OSCP^®-style labs are downloadable Active Directory chains: Chain_01 (First Contact) and Chain_03 (BleedWide), each with a full video walkthrough that's free on YouTube. The walkthrough for Chain_07 (Crosslink) is free to watch too, though the Chain_07 lab itself is one of our paid chains.

Each chain is three virtual machines, two Windows clients and a domain controller, that run on your own computer. You start with a domain username and password and work toward full control of the domain, the same starting point as the Active Directory set on the OSCP+^™ (OSCP Plus) exam. Free standalone practice boxes are easy to find. Free practice in that three-machine, assumed-breach format is much harder to come by, which is why we built these.

This guide covers what each chain trains, how to run it under exam conditions, and which part of each walkthrough to open when you get stuck, without giving the attack path away.

We're Hacker Blueprint. Our instructor holds the OSCP and built these chains, our academy has more than 600 students, and around 7,000 people have claimed our prep materials. The free chains have been shared widely on r/oscp.

What you get with the free AD chains

Chain_01 and Chain_03 each have a GET IT FREE button on the labs page. Every chain, free or paid, is built the same way:

• Three VMs that form a working domain: two Windows clients and one domain controller.
• A quick setup guide and a setup video. Import the OVA files into VirtualBox, put all three machines on the same internal network, and the video walks you through the rest.
• A full walkthrough. For Chain_01 and Chain_03 it's free on YouTube, and you'll find both embedded below.

The labs run fully offline once downloaded. That matters more than it sounds: you can reset the whole domain whenever you like and run the same chain as many times as you want, which is exactly what exam practice needs.

If you're on 8 GB, the setup video has tips for running the domain alongside your attack machine, and our full lab requirements cover RAM, CPU and disk in detail. On an Apple Silicon Mac, read about practicing on a Mac for the options that do work. If setting up VMs is new to you, our free academy has a beginner path on virtual machines and Linux.

One habit before your first attempt: take a VirtualBox snapshot of all three machines. You'll need a clean domain for the redo later in this guide.

The free chains at a glance

The labs page doesn't label chains by difficulty, to keep the OSCP-style feel, and its FAQ is clear about where to begin: Chain_01, which is free and beginner-friendly. Do Chain_03 next.

How to practice the free chains like the exam

On the OSCP+, the AD set is three machines worth 10, 10 and 20 raw points, the biggest single block on the exam. For exams starting on or after December 1, 2026, raw points convert to a scaled score, which we explain in OSCP+ scaled scoring. The AD set stays the part most worth practicing, and our breakdown of whether you can pass the OSCP+ without Active Directory shows why skipping it doesn't add up. A chain only trains you for that set if you treat it like the exam. Watch the walkthrough first and you've had a video lesson. This routine is built on OffSec's own AD preparation advice:

1. Go in blind. Start from your snapshot and skip the walkthrough completely, even the opening minutes. The first attempt is where you find out what your methodology misses.
2. Set a 4-hour timer. OffSec's AD prep guide suggests a timer per machine on exam day, with 4 hours for the whole AD set, split across its machines. When the timer rings, write down how far you got. You can keep going after that, but you now have an honest baseline.
3. Take notes as if you'll write the report. Log every credential, which hosts and services it works on, and every command with its output. OffSec's guide says to document all commands, outputs, scripts and code you use. Practice the screenshot habit too: whenever you take over a machine, capture it with that machine's IP address in the same frame, the way the exam guide requires for proof files. Our OSCP report template guide shows how to set up OffSec's official template with a section for each machine to fill in as you go.
4. Run your checklist before you open the video. OffSec's guide says that when you gain domain user access to a machine, you should enumerate the domain again as that user, and it calls this "often overlooked". Try everything you've found on every machine, and check if a host you control can see a network you can't. Our OSCP+ Active Directory methodology has the full loop.
5. Watch one step, then close it. Open the walkthrough at the chapter that matches where you stopped, and watch until the instructor gains the next new credential or access. Pause there and carry on alone. Write the step you missed into your notes, because that missed step is the thing you're training. The video in our OSCP exam tips has a chapter on using walkthroughs strategically.
6. Redo it a week later without help. Restore the snapshot and run the chain again with the walkthrough and your old notes closed. OffSec's guide gives the same advice for its own AD sets: once you've finished them, redo them without looking at your notes. When you can finish a chain inside 4 hours with no help, move to the next one.

Chain_01, First Contact: where to start

The labs page subtitles Chain_01 "Understanding the domain" and describes it as building a foundation for attacking Active Directory environments. You begin as an ordinary domain user, and the goal is full control of the domain controller.

What it trains: finding the hosts and services in the domain, enumerating domain users and SMB shares, reading BloodHound data, password spraying and credential reuse, cracking hashes, Windows privilege escalation, pass-the-hash, and collecting credentials once you're admin on a machine. The walkthrough's main lesson is that much of lateral movement comes down to collecting every credential you can and testing each one everywhere it might work.

Try these before you watch:

• Map every host, every open port and every domain user, and keep the lists in your notes.
• Test every credential you hold against every machine and every service that accepts a login, including ones that failed earlier.
• Once you're admin anywhere, collect every credential that machine holds before you move on.

Where to open the walkthrough when you're stuck. With no foothold yet, start at 5:09. Stuck after your first shell, start at 14:08. Stuck short of the domain controller, start at 25:07. In every case, stop as soon as a new credential or a new login appears, and go back to the lab.

The walkthrough is My Pentesting Methodology for Any Exam (How I Hack Active Directory), 49 minutes. For more on this chain, read the full Chain_01, First Contact writeup.

Chain_03, BleedWide: the second free chain

Chain_03 is subtitled "Expanding influence", and the labs page sums it up as expanding domain access through coordinated AD attacks and spraying. It has the same shape as Chain_01: three machines and a set of starting domain credentials.

What it trains: LDAP and domain enumeration, BloodHound, Kerberos-based attacks, Windows privilege escalation, hash dumping and offline cracking, password reuse and pass-the-hash.

The walkthrough closes on a lesson worth taking into the exam. BloodHound shows domain-level attack paths reliably, but a user's groups in the graph won't always tell you where that user can sign in. So test every credential on every protocol of every host and let the results decide.

Try these before you watch:

• Collect BloodHound data early and read it properly: who the domain admins are, and what your current user can reach.
• Run more than one Windows privilege escalation check on every machine you land on, and confirm each finding by hand before you trust it.
• Start long cracking jobs early and keep enumerating while they run.

Where to open the walkthrough when you're stuck. Before your first shell, start at 3:40. With a shell but no admin rights, start at 16:05. With admin on a client and no new user to work with, start at 21:18. Further along and stuck, start at 28:38.

The walkthrough is Hacking Active Directory Chains Methodology (Full Guide!), 51 minutes. We also use it in our AD methodology guide, so if you've already watched it there, you know the path. Run Chain_03 anyway as a speed drill against the 4-hour timer. For more on this chain, read the full Chain_03, BleedWide writeup.

Chain_07, Crosslink: a free walkthrough for a paid lab

To be plain about it: the Chain_07 lab is one of our paid chains, and its full walkthrough is free on YouTube. It went up on September 28, 2026 and is the most-watched of the three walkthroughs.

The labs page subtitles Chain_07 "Tunneling through the invisible": abusing trusted access, moving through isolated networks and escalating across hidden infrastructure. It's the first chain with official VMware support alongside VirtualBox.

What it trains: pivoting and tunneling to reach machines your attack box can't see, Windows privilege escalation, AD and SMB enumeration, and credential dumping and reuse. Pivoting is the topic we see students fail the AD set on most often, and OffSec's exam FAQ says there may be pivoting required on the AD machines. Chain_07 is built around it.

How to use the free walkthrough:

• If you plan to buy Chain_07, hold off on the video until you've made your own attempt, because it shows the whole path from start to finish. Then watch only the stretch where you got stuck.
• If you're only watching, treat it as a pivoting study. Pause each time the video reaches a new network, and write down how you'd get traffic there before the instructor does it.
• To learn the tunneling tools first, our Pivoting and Network Tunneling playlist covers Ligolo-ng and Chisel.
• The video has no chapters yet. At 2 hours 33 minutes, it helps to jot down the timestamp each time a new machine or network comes into play, so you can jump back later.

The walkthrough is OSCP Practice Lab: Active Directory Attack Path (FULL Walkthrough).

Where the paid chains fit after the free ones

Once you can finish Chain_01 and Chain_03 inside 4 hours without the walkthrough, move on to the paid chains on the labs page. Each one is the same three-VM domain with its own attack path from foothold to domain admin, and each comes with a guided walkthrough. Pick them by your weakest topic: if pivoting is the gap, Chain_07 is the obvious next chain.

Every plan on the pricing page also includes our custom OSCP-style AD attack chain walkthroughs, and the monthly plan starts with a free trial. More chain walkthroughs are in our OSCP Practice Labs: AD Attack Chains playlist on YouTube.

If Chain_01 feels out of reach, build the theory first. Our free 2-hour OSCP course walks through a full domain compromise, and the Hacking Active Directory Course for Beginners (5+ hours, more than 30,000 views) starts AD from zero. To see where AD practice sits in a full study plan, from Linux basics to exam day, read the OSCP+ roadmap.

FAQ

Are there free OSCP labs for Active Directory?

Yes. Our Chain_01 and Chain_03 are free to download from the labs page, and each has a full walkthrough free on YouTube. Each one is a three-machine domain that starts from a domain user, the same format as the OSCP+ AD set.

Is the Chain_07 lab free?

The Chain_07 walkthrough is free on YouTube, and the lab is one of our paid chains. You can buy it on its own from the labs page, or get it in the Chain Labs Bundle or the Ultimate Bundle.

What do I need to run the free OSCP labs?

At least 8 GB of RAM (16 GB recommended) and a Windows or Linux PC with an Intel or AMD processor, or an older Intel Mac. Chain_01 and Chain_03 run on VirtualBox. They don't run on Apple Silicon Macs or Snapdragon Windows laptops.

Should I watch the walkthrough before trying a chain?

Try the chain blind first, on a 4-hour timer, and open the walkthrough only after you've stopped. Start from the chapter that matches where you got stuck, then close it and carry on alone.

How close are the free chains to the OSCP+ AD set?

They share its shape: three machines, two clients and a domain controller, starting from a domain username and password. They're our own builds and contain no exam content, so treat them as practice for the format and your methodology.

Do the free AD labs need an internet connection?

No. Once downloaded, all three VMs run fully offline on your own computer.

Start your first free chain

Download Chain_01 from the labs page, take a snapshot, set a 4-hour timer and go in blind. Keep the walkthrough closed until you've stopped, then redo the chain a week later without it.

One of our students, skibenzenebf, wrote: "I earned my OSCP+. The resources, such as AD chains (virtual machines) and notes, were very helpful and prepared me for the exam." (More reviews)

Try our 30+ hour course for OSCP prep with a free trial, or start with one of our free Active Directory chains.

Stuck on a chain? Ask in the Hacker Blueprint Discord.

Sources

• OffSec: OSCP+ Exam Guide (AD set of three machines, username and password provided at the start, 10/10/20 raw points, proof screenshot rules)
• OffSec: OSCP+ Exam FAQ (pivoting may be required on the AD machines)
• OffSec: OSCP+ Exam with AD Preparation (4-hour timer for the AD set, enumerating the domain again as each new user, documenting commands and output, redoing AD sets without notes)
• OffSec: OSCP+ Equated Scaled Scoring FAQ (scaled scoring for exams starting on or after December 1, 2026 at 08:00 GMT)
• Hacker Blueprint: My Pentesting Methodology for Any Exam (How I Hack Active Directory) (YouTube, Dec 13, 2025; Chain_01 walkthrough)
• Hacker Blueprint: Hacking Active Directory Chains Methodology (Full Guide!) (YouTube, Nov 14, 2025; Chain_03 walkthrough)
• Hacker Blueprint: OSCP Practice Lab: Active Directory Attack Path (FULL Walkthrough) (YouTube, Sep 28, 2026; Chain_07 walkthrough)