HTB: Arctic
Windows machine built around an Adobe ColdFusion remote code execution bug, escalated to SYSTEM with a kernel exploit.
exploit-db
HTB: Chatterbox
Windows machine centred on an AChat buffer overflow with custom shellcode, then credential discovery and password reuse for Administrator.