HTB: Escape
Active Directory machine where MSSQL abuse leaks credentials that feed into an AD CS certificate attack for full domain compromise.
kerbrute
HTB: Blackfield
Active Directory machine covering AS-REP Roasting, BloodHound-guided lateral movement, LSASS credential extraction, and Backup Operators abuse.
HTB: Monteverde
Machine built around an Azure AD Connect misconfiguration that leaks credentials and leads to domain compromise.
HTB: Sauna
Active Directory machine generating valid usernames, AS-REP Roasting an account, recovering AutoLogon credentials, and finishing with a DCSync attack.