EscapeTwo is an easy Windows machine that demonstrates a full Active Directory domain compromise by chaining credential recovery, credential spraying, MSSQL and WinRM access, and the exploitation of a misconfigured ADCS deployment to obtain the Administrator hash.
# tag: ESC4
EscapeTwo