impacket

Windows machine exploiting an unprotected change-password endpoint via CSRF to hijack an account, planting a PHP webshell through an SMB-writable IIS site, and recovering Administrator credentials from a WSL bash history file.

Windows machine recovering Umbraco credentials from a world-readable NFS share, exploiting an authenticated Umbraco RCE for a foothold, and decrypting a TeamViewer 7 password from the registry for SYSTEM.

Windows machine extracting MSSQL credentials from an Excel macro, capturing and cracking an NTLMv2 hash via xp_dirtree, enabling xp_cmdshell, and decrypting a Group Policy Preferences password for Administrator.

Windows machine chaining PHP session poisoning for code execution, SMB-hosted RFI for a webshell, reused database credentials, and a malicious CHM help file for administrator.

Windows machine using a Jenkins build step for remote code execution, a KeePass database for a Pass-the-Hash credential, and an alternate data stream hiding the root flag.