netexec

Windows machine using a Jenkins build step for remote code execution, a KeePass database for a Pass-the-Hash credential, and an alternate data stream hiding the root flag.

Windows machine centred on an AChat buffer overflow with custom shellcode, then credential discovery and password reuse for Administrator.

Active Directory machine where MSSQL abuse leaks credentials that feed into an AD CS certificate attack for full domain compromise.

Active Directory box where exposed SMB shares leak credentials that get reused, then Backup Operators membership is abused to dump domain hashes.

Active Directory machine covering AS-REP Roasting, BloodHound-guided lateral movement, LSASS credential extraction, and Backup Operators abuse.

Active Directory box capturing NTLM hashes, abusing SMB access and password reuse, pivoting through IIS, and escalating via SeImpersonatePrivilege.

Active Directory box capturing LDAP credentials through a printer admin panel, gaining WinRM access, and abusing Server Operators rights to DCSync.

Active Directory box where exposed SMB backups lead to certificate-based WinRM access, PowerShell history credential discovery, and LAPS abuse.

Machine built around an Azure AD Connect misconfiguration that leaks credentials and leads to domain compromise.

Active Directory machine generating valid usernames, AS-REP Roasting an account, recovering AutoLogon credentials, and finishing with a DCSync attack.