HSWindows
Orion
Two-machine Active Directory lab: NTLM theft from a writable share, Kerberoasting, BloodHound ACL abuse with shadow credentials, and ADCS ESC1 to Domain Admin.
Easy
HS
Hack Smarter
Realistic scenario-driven labs and machines.
HSWindows
Odyssey
Three-host black-box engagement (Linux web + 2 Windows) in a degraded AD where remote LDAP is broken. SSTI foothold, credential reuse into a workstation, Backup Operators SAM dump, and GPO abuse to Domain Admin.
Hard
HSWindows
Forensics
Assumed-breach, OSCP-style AD lab (DC + 2 member servers). Targeted Kerberoasting, a cracked Access database, and a service misconfiguration lead to SYSTEM. A DA ticket left behind on a forensics box finishes it with DCSync.
Medium