SMB

Linux machine chaining SMB enumeration, new-line command injection on an in-development router panel, cron job abuse, and a patched Diamorphine LKM rootkit for root.

Active Directory machine capturing NTLM hashes from a writable SMB share, Kerberoasting a service account, forging an MSSQL Silver Ticket, and escalating via SeImpersonatePrivilege.

Active Directory box enumerating users over SMB, reusing a weak password, abusing a writable logon script, and escalating through GPO.

Active Directory machine combining anonymous LDAP enumeration, password reset abuse, SeRestorePrivilege execution, and a manual NTDS extraction.

Windows box recovering Cisco device passwords, RID brute forcing usernames, password spraying, and pulling credentials from Firefox process memory.

Windows box abusing a path-traversal bug in hMailServer for credentials, capturing NTLM via a crafted email, and executing code through LibreOffice.

Windows machine extracting MSSQL credentials from an Excel macro, capturing and cracking an NTLMv2 hash via xp_dirtree, enabling xp_cmdshell, and decrypting a Group Policy Preferences password for Administrator.

Windows machine using a Jenkins build step for remote code execution, a KeePass database for a Pass-the-Hash credential, and an alternate data stream hiding the root flag.

Active Directory box where exposed SMB shares leak credentials that get reused, then Backup Operators membership is abused to dump domain hashes.

Active Directory machine covering AS-REP Roasting, BloodHound-guided lateral movement, LSASS credential extraction, and Backup Operators abuse.