Pass the Hash

Active Directory box enumerating users over SMB, reusing a weak password, abusing a writable logon script, and escalating through GPO.

Windows machine using a Jenkins build step for remote code execution, a KeePass database for a Pass-the-Hash credential, and an alternate data stream hiding the root flag.

Active Directory machine generating valid usernames, AS-REP Roasting an account, recovering AutoLogon credentials, and finishing with a DCSync attack.

Active Directory machine built on anonymous LDAP enumeration, AS-REP Roasting, nested group abuse, and a DCSync attack for domain compromise.