Runas

Windows machine where anonymous FTP exposure leads to credential recovery from MDB and PST backups, Telnet access, and stored-credential abuse via runas /savecred.

Windows kiosk-style box breaking out through RDP and Edge file-system browsing, bypassing binary restrictions by renaming executables, recovering a password from Remote Desktop Plus, and elevating UAC through the GUI.