HTB: Heist
Windows box recovering Cisco device passwords, RID brute forcing usernames, password spraying, and pulling credentials from Firefox process memory.
WinRM
HTB: Mailing
Windows box abusing a path-traversal bug in hMailServer for credentials, capturing NTLM via a crafted email, and executing code through LibreOffice.
HTB: Giddy
Windows machine using MSSQL injection to force NTLM authentication, gain WinRM access, and abuse the UniFi Video service for SYSTEM.