🏰 GOAD-Light on VMware + Windows — The Complete Setup Guide

A battle-tested, step-by-step guide to deploy GOAD-Light (Game of Active Directory) on VMware Workstation with a Windows host, written after solving every real-world trap the official docs skip.

🌍 Language: English (this file) · 🇹🇷 Türkçe

---

📖 What is this?

GOAD (Game of Active Directory) by Orange Cyberdefense is an intentionally vulnerable Active Directory lab — excellent for OSCP / OSCP+ AD practice, pentest training, and red-team drills.

Deploying it on Windows + VMware Workstation hits several undocumented traps that can cost you an entire day. This repo is the guide I wish I'd had: it folds every fix into the main flow, plus ready-to-run fix scripts.

GOAD-Light = 3 VMs, 1 forest, 2 domains — lighter on RAM and a near-perfect match for the OSCP 3-machine AD chain.

⚡ Why this guide is different

Most tutorials get you to install and leave you stranded. This one pre-solves the five traps that break GOAD on Windows:

#	Trap	Symptom	Fix
1	Python 3.13/3.14 too new	configparser.InvalidWriteError ... delimiter :	Use Python 3.12
2	GOAD windows.py bug	TypeError: is_in_path() takes 2 positional arguments but 3	01-fix-windows-py.ps1
3	Host not on lab network	Kali/host can't ping DCs (VMs can ping each other)	02-setup-host-network.ps1
4	PROVISIONING VM has no IP	ssh: connect to 192.168.56.3 ... timed out	03-fix-provisioning-ip.sh
5	SSMS install hangs	Stuck 30+ min on Install SSMS on srv02	04-disable-ssms.sh

Good news: the vagrant-vmware-desktop plugin no longer needs a paid license (open-sourced under MPL, late 2025), and VMware Workstation Pro is free for personal use.

---

🗺️ Architecture

┌─────────────────────────────────────────────────────────────┐
│  WINDOWS HOST (VMware Workstation)                            │
│   • goad.py + Vagrant  (orchestrator — runs on the host)     │
│   • host-only vmnet adapter: 192.168.56.1                    │
│                                                               │
│   ┌──────────────── VMware (host-only 192.168.56.0/24) ────┐ │
│   │  Kali (.250)  ← attacker                                │ │
│   │  PROVISIONING (.3)  ← temp Ubuntu box, runs Ansible     │ │
│   │  DC01 kingslanding (.10)  sevenkingdoms.local           │ │
│   │  DC02 winterfell   (.11)  north.sevenkingdoms.local     │ │
│   │  SRV02 castelblack (.22)  north.* (Defender OFF)        │ │
│   └──────────────────────────────────────────────────────────┘ │
└─────────────────────────────────────────────────────────────┘

goad.py + Vagrant must run on the host (the vagrant-vmware-desktop plugin drives the host's VMware). Ansible runs inside the auto-created PROVISIONING VM (-m vm method).

---

✅ Prerequisites

• Windows 10/11 host with ~80–120 GB free disk and 32 GB RAM recommended
• CPU virtualization (VT-x/AMD-V) enabled in BIOS
• Host power settings → never sleep (so downloads/reboots don't get interrupted)
• Kali already installed as a VM in VMware

---

🚀 Setup

Phase 1 — Windows host tooling

1. Visual C++ 2019 Redistributable
2. Vagrant → reboot
3. Vagrant VMware Utility (driver) — mandatory
4. Plugins (Admin PowerShell):

   vagrant plugin install vagrant-reload vagrant-vmware-desktop winrm winrm-fs winrm-elevated

Phase 2 — Python 3.12 + GOAD

⚠️ Use Python 3.12, not 3.14. Python 3.13+ tightened configparser and breaks GOAD.

:: install Python 3.12 first (py install 3.12  OR python.org classic installer)
cd C:\lab
git clone https://github.com/Orange-Cyberdefense/GOAD.git
cd GOAD
py -3.12 -m venv .env
.env\Scripts\python.exe --version           :: MUST say 3.12.x
.env\Scripts\python.exe -m pip install --upgrade pip
.env\Scripts\python.exe -m pip install -r noansible_requirements.yml

🔑 From now on always use .env\Scripts\python.exe goad.py, never py goad.py.

Phase 2.5 — Fix the GOAD windows.py bug (mandatory)

powershell -ExecutionPolicy Bypass -File scripts\01-fix-windows-py.ps1

Phase 3 — Network (the critical part)

The lab uses 192.168.56.0/24. In VMware → Edit → Virtual Network Editor (Admin):

• Select/create the host-only vmnet on 192.168.56.0/24, mask 255.255.255.0
• ☑ "Connect a host virtual adapter to this network" ← easy to miss, breaks everything if off
• ☐ "Use local DHCP service" → OFF (GOAD uses static IPs)

Then give the host adapter an IP + firewall rule:

:: Run as Administrator
powershell -ExecutionPolicy Bypass -File scripts\02-setup-host-network.ps1

Add a second NIC to Kali (VM off): Adapter 1 = NAT, Adapter 2 = the 56.x vmnet. In Kali:

sudo nmcli con add type ethernet con-name goad-net ifname eth1 ip4 192.168.56.250/24
sudo nmcli con up goad-net

Phase 4 — Install

.env\Scripts\python.exe goad.py -m vm

> check                    # everything green
> set_provider vmware
> set_lab GOAD-Light
> set_ip_range 192.168.56
> install                  # confirm with y

Phase 4.6 — Fix the PROVISIONING IP (you WILL hit this on Windows)

When you see ssh: connect to host 192.168.56.3 port 22: Connection timed out:

1. Ctrl+C the install (VMs are NOT destroyed)
2. VMware tray icon → "Open All Background Virtual Machines" → open PROVISIONING → login vagrant/vagrant
3. Run (copy the script over, or type the commands):

   sudo bash 03-fix-provisioning-ip.sh          # or --persist for netplan

4. Back on host: ping 192.168.56.3, then re-run install.

Phase 4.7 — Disable SSMS if it hangs

If provisioning stalls 30+ min on Install SSMS on srv02:

# inside PROVISIONING (where ~/GOAD/ansible lives)
bash 04-disable-ssms.sh

Then re-run install. SSMS is optional — MSSQL and all vulns install before it.

Phase 5 — Verify + snapshot

# from Kali
nxc smb 192.168.56.10 192.168.56.11 192.168.56.22

You should see sevenkingdoms.local, north.sevenkingdoms.local, and the three hostnames. Then:

:: in workspace\<INSTANCE-ID>-goad-light-vmware\provider
vagrant snapshot save clean-goad

<INSTANCE-ID> is unique to your machine — check your workspace\ folder.

---

🩹 Fix Scripts

Script	Runs on	Purpose
01-fix-windows-py.ps1	🪟 Host (GOAD root)	Patch is_in_path() bug
02-setup-host-network.ps1	🪟 Host (Admin)	Host vmnet IP + firewall
03-fix-provisioning-ip.sh	🐧 PROVISIONING VM	Set 192.168.56.3
04-disable-ssms.sh	🐧 PROVISIONING VM	Comment out SSMS play
check-network.ps1	🪟 Host	Connectivity diagnostic

---

🎯 Attack Quickstart (Kali)

Add to /etc/hosts:

192.168.56.10   kingslanding.sevenkingdoms.local kingslanding sevenkingdoms.local
192.168.56.11   winterfell.north.sevenkingdoms.local winterfell north.sevenkingdoms.local
192.168.56.22   castelblack.north.sevenkingdoms.local castelblack

Technique	Target user	Tool
AS-REP Roasting	brandon.stark	impacket-GetNPUsers → hashcat -m 18200
Kerberoasting	jon.snow	impacket-GetUserSPNs → hashcat -m 13100
Password Spray	hodor (user=pass)	nxc smb ... spray
LLMNR + NTLM Relay	responder bots	responder + ntlmrelayx
ACL abuse chain	jaime→joffrey→…→varys→DA	BloodHound + bloodyAD
MSSQL + impersonation	jon.snow, arya.stark	impacket-mssqlclient
GPO abuse	STARKWALLPAPER	SharpGPOAbuse

Recommended toolkit: mimikatz · chisel · evil-winrm · impacket · proxychains · BloodHound legacy 4.2/4.3 (not the newer CE — most guides/exam material target legacy).

---

🔒 Security note

GOAD is intentionally vulnerable. The vulnerabilities live inside the VMs, sandboxed by VMware on a host-only network. Your host is not made vulnerable — just never bridge the lab VMs to your real network.

🙏 Credits

• GOAD by Orange Cyberdefense — the lab itself
• Fixes distilled from a real end-to-end deployment + community issues (#376)

📄 License

MIT — see LICENSE. This is community documentation; GOAD itself is licensed separately by Orange Cyberdefense.

---

⭐ If this saved you a day of debugging, a star helps others find it.