AD SET
Active Directory sets
A small domain to break into and move through. For example a web server, a SQL server and a domain controller.
- Hosts
- Several
- Session
- 4 h, up to 8 h
Practise for the OSCP on real Active Directory labs
Launch a private lab, connect from your own Kali and work it the way the exam is taken. Onyx, your AI mentor, helps as much as you choose, down to not at all.
Labs come with Practitioner at $49 a month, after a 7-day trial.
The lab workspace mid-run, with Onyx at Coach.
How it works
The same loop as the exam, with a mentor you control.
-
Choose your tier
Start at C1 if OSCP-style work is new to you, or higher if standalone boxes are comfortable. My Path tracks what you finish.
-
Launch a private lab
Pick a scenario. Its machines start on a network that only your VPN can reach.
-
Work it like the exam
Connect your Kali over OpenVPN, find the hosts and break in. Onyx helps at the level you pick, or stays silent.
-
Submit flags, get a debrief
Submit each flag as you find it. When the lab ends, Onyx writes a debrief of what went well and what to drill next.
Labs built like the exam
Three kinds of lab, each on machines that are yours for the session.
STANDALONE
Standalone machines
One machine. Enumerate it, find a way in and escalate to full control.
- Hosts
- 1
- Session
- 4 h, up to 8 h
EXAM SIM
Exam simulations
A full timed run, like the real exam. Onyx stays silent and the run is logged as clean.
- Hosts
- Full exam set
- Session
- Up to 24 h
New scenarios are added to the catalogue as they are finished. You see the full list when you sign in.
Onyx helps as much as you ask
Six help levels, from silent to step by step. Every run records the level you used, so your progress reflects what you can do on your own.
SilentStep by step
Exam sim
Level 1 of 6Silent. Onyx does not answer for the whole run, and the run is logged as clean.
AD set · foothold on the web server
YOU
I have a shell on the web server as a domain user. The objective is Domain Admin. What next?
Onyx is off for this run. The run is logged as clean.
Shadow
Level 2 of 6Onyx observes and answers only direct questions about methodology.
AD set · foothold on the web server
YOU
I have a shell on the web server as a domain user. The objective is Domain Admin. What next?
ONYX
As a matter of method: after a foothold, enumerate the domain before you touch new hosts. I will not point at a specific account or machine at this level.
Nudge
Level 3 of 6Short directional hints when you ask. No commands.
AD set · foothold on the web server
YOU
I have a shell on the web server as a domain user. The objective is Domain Admin. What next?
ONYX
Look at the accounts that run services.
Coach
Level 4 of 6Hints escalate when you are stuck. Onyx explains why, not what.
AD set · foothold on the web server
YOU
I have a shell on the web server as a domain user. The objective is Domain Admin. What next?
ONYX · HINT 1 OF 4
You have valid domain credentials. Before you touch the internal subnet, ask the domain which accounts run services. One weak service account is usually the way off this foothold.
Teach
Level 5 of 6Explains techniques in depth, with references to the host you are on.
AD set · foothold on the web server
YOU
I have a shell on the web server as a domain user. The objective is Domain Admin. What next?
ONYX
Service accounts in Active Directory are registered with service principal names. Any domain user, including the one you have, can request a ticket for one of those services, and part of that ticket is protected by the service account's password. If that password is weak, it can be recovered offline. That is Kerberoasting, and it is why service accounts are worth a look from a foothold like this.
Walkthrough
Level 6 of 6Concrete commands for the current step. Onyx asks you to confirm first, and the run records it.
AD set · foothold on the web server
Switch to Walkthrough?
Onyx will give concrete commands for the current step. The change is recorded on this run and shown in your debrief. You can step back down at any time.
Stay on TeachSwitch to Walkthrough
Exam realism, on purpose
The lab gives you what the exam gives you, and nothing more. You discover the rest.
Host
SQL01
- IP
- 172.16.20.11
- Exposure
- Internal
- OS
- Not found yet
- Role
- Not found yet
- Open ports
- Not found yet
- OS
- Windows
- Role
- SQL Server 2019, domain member
- Open ports
- 13544514335985
The host panel starts with what the exam gives you
Its name, its IP and whether you can reach it from your VPN. The OS, role and open ports fill in as you discover them, and so does the network map.
Submit a flag
HostWEB01 10.13.37.10
Flag4f9a1c7e2b8d6054a3f1...
Show the flag, the host name and its IP address in one screenshot.
Flags go in per host, with the screenshot rule
Paste each flag against its host as you find it, and Rootpanther works out whether it is local.txt or proof.txt. The exam's screenshot rule stays in front of you, so your evidence is ready for the report.
Onyx · Exam sim Clean run
- Type
- Exam simulation
- Time limit
- 24 hours
- Help used
- None
Onyx is silent for this run.
Exam simulation is silent
A full timed run of up to 24 hours, like the real exam. Onyx says nothing, and the run is logged as clean.
My Path: four tiers to exam-ready
Move up by finishing real work. For example, three C2 scenarios completed without the two highest help levels, plus one passed report.
-
C1
Apprentice
New to OSCP-style work. Single hosts, enumeration and your first privilege escalations.
-
C2
Practitioner
Comfortable on standalone boxes. Small AD sets, Kerberoasting and pivoting.
-
C3
Adept
Working through AD chains. ACL abuse, delegation and multi-hop pivots.
-
C4
Master
Exam-ready. Forest trusts, certificate abuse and full timed simulations.
Write the report as you go
The exam is passed on the report as much as on the flags. Practise both.
- Notes become evidence. Commands and output you save in the lab are ready to insert into your report.
- Export to PDF or Markdown. Keep your reports and reuse your write-ups.
- A debrief after every lab. What you did well, what you missed, and a drill for the gap.
Security in brief
You attack the lab. Nobody else does.
An isolated network per session
Each lab gets its own network. Only your VPN reaches it.
Flags stored as keyed hashes
Never in plain text.
Two-factor sign-in
Authenticator app or recovery codes. Security changes need a fresh confirmation and send you an email.
Hosted in Western Europe
On Microsoft Azure.
Simple pricing
Start free. Labs come with Practitioner, or with Team for 3 seats or more.
Free
Primers, drills and playbooks before you need a lab.
$0
No lab hours
- Concept primers for tier C1
- Drills, no lab needed
- Methodology playbooks
- Onyx in mentor mode, 10 messages a day
Practitioner
For OSCP candidates working through real labs.
$49a month
Or $490 a year. 7-day trial.
- Every AD set, standalone and exam simulation
- 60 lab hours a month, and extra hours to buy
- Onyx at every help level, not metered
- Your own Kali over OpenVPN
- Kali in the browser Coming soon
- A debrief after every lab
- Report exports in PDF and Markdown
- All primers, drills and playbooks
Team
For training leads buying 3 seats or more.
$45per seat a month
Or $450 per seat a year. 3 seats minimum.
- Everything in Practitioner, per seat
- 60 lab hours a month per seat
- Assign and reassign seats
- Team progress: tiers, labs and reports
- One invoice for all seats
Questions
Something else? Email support@rootpanther.com.
Is Rootpanther affiliated with OffSec?
No. Rootpanther is an independent practice platform. OSCP and OffSec are trademarks of OffSec Services LLC, and Rootpanther is not affiliated with or endorsed by OffSec.
Practice here builds the skills the exam tests. It does not promise a pass.
Do I need my own Kali?
Yes, to connect over OpenVPN, the way the exam works. Download your profile from the lab and run sudo openvpn rootpanther-lab.ovpn.
Paid plans will also get a Kali terminal in the browser, for when you are away from your own machine. Coming soon
What happens when I reach 60 lab hours?
You can buy extra hours (10 extra hours for $15) or wait until your hours reset on your billing date. A session that is already running carries on to its end, so you are never cut off mid-attack. Unused monthly hours do not carry over.
Can I pause or cancel?
Cancel any time from Billing. You keep access until the end of the period you paid for, and your notes, flags, progress and reports stay on your account. You can also pause billing for 1 to 3 months.
Does Onyx give me the answers?
Only at Walkthrough, and only after you confirm. Every run records the help level you used, so your progress shows what you did on your own. Onyx never hands out flags, and it is silent during exam simulations.
Is my data used to train AI?
Your lab activity and Onyx conversations are not used to train AI models. Onyx runs on models from Anthropic, listed on our subprocessors page.
Start on the free plan
Primers, drills and Onyx cost nothing. Start the 7-day trial when you want your first lab.