VulnLab

Active Directory machine capturing NTLM hashes from a writable SMB share, Kerberoasting a service account, forging an MSSQL Silver Ticket, and escalating via SeImpersonatePrivilege.

Active Directory box enumerating users over SMB, reusing a weak password, abusing a writable logon script, and escalating through GPO.

Active Directory machine combining anonymous LDAP enumeration, password reset abuse, SeRestorePrivilege execution, and a manual NTDS extraction.

Windows machine exploiting an exposed Gitea access token, abusing repository-backed web deployment, recovering mRemoteNG credentials, and escalating through PDF24.

Windows box driven by macro-based phishing, hMailServer database credential recovery, lateral movement over RDP, and Veeam Backup exploitation.

Windows machine starting from a phishing LibreOffice document, abusing IIS web root access, and escalating with SeImpersonatePrivilege via GodPotato and RunasCs.

Windows kiosk-style box breaking out through RDP and Edge file-system browsing, bypassing binary restrictions by renaming executables, recovering a password from Remote Desktop Plus, and elevating UAC through the GUI.

Linux machine exploiting a Grafana arbitrary file read, cracking the recovered credentials, and escaping a privileged Docker container after SSH access.

Linux machine reached through anonymous rsync access, cracking a salted MD5 hash, planting an SSH key via FTP, reusing a password, and abusing a cronjob for root.