HTB: Flight
Active Directory box capturing NTLM hashes, abusing SMB access and password reuse, pivoting through IIS, and escalating via SeImpersonatePrivilege.
SMB
HTB: Return
Active Directory box capturing LDAP credentials through a printer admin panel, gaining WinRM access, and abusing Server Operators rights to DCSync.
HTB: Timelapse
Active Directory box where exposed SMB backups lead to certificate-based WinRM access, PowerShell history credential discovery, and LAPS abuse.
HTB: Monteverde
Machine built around an Azure AD Connect misconfiguration that leaks credentials and leads to domain compromise.
HTB: Active
Classic Active Directory box where GPP credential exposure opens the door to Kerberoasting and full domain compromise.