EscapeTwo is an easy Windows machine that demonstrates a full Active Directory domain compromise by chaining credential recovery, credential spraying, MSSQL and WinRM access, and the exploitation of a misconfigured ADCS deployment to obtain the Administrator hash.
# tag: Active Directory
EscapeTwo
CicadaCicada is an easy-difficult Windows machine that focuses on beginner Active Directory enumeration and exploitation. In this machine, players will enumerate the domain, identify users, navigate shares, uncover plaintext passwords stored in files, execute a password spray, and use the `SeBackupPrivilege` to achieve full system compromise.
Retro2Retro2 is a Windows AD challenge involving guest SMB access to an MS Access database, LDAP credential recovery from VBA, and lateral movement via machine account abuse, concluding with a privilege escalation to SYSTEM through RpcEptMapper.
RetroComprehensive walk-through of the Retro machine, demonstrating a transition from guest SMB access to Domain Admin. The process involves credential harvesting from public shares, exploiting pre-created computer accounts via Kerberos TGT requests, and leveraging misconfigured AD CS templates (ESC2/ESC3) for identity impersonation.
BabyThis challenge involved enumerating a Windows domain environment, obtaining valid credentials, and abusing SeBackupPrivilege to extract and decrypt the NTDS database, ultimately achieving domain administrator access.