HTB: Jeeves
Windows machine using a Jenkins build step for remote code execution, a KeePass database for a Pass-the-Hash credential, and an alternate data stream hiding the root flag.
KeePass
HTB: Keeper
Linux machine abusing default Request Tracker credentials for SSH access, then recovering a KeePass master password from a memory dump to extract a root PuTTY SSH key.