Index

Writeups

Step-by-step walkthroughs of retired machines and challenges. Filter by platform, difficulty, OS or technique - or just start typing.

3 / 3

Platform

Difficulty

Oct 17, 2026/9 min read

Orion

Two-machine Active Directory lab: NTLM theft from a writable share, Kerberoasting, BloodHound ACL abuse with shadow credentials, and ADCS ESC1 to Domain Admin.

Easy

#active directory
#smb
#ntlm theft
+5

Oct 3, 2026/6 min read

Three-host black-box engagement (Linux web + 2 Windows) in a degraded AD where remote LDAP is broken. SSTI foothold, credential reuse into a workstation, Backup Operators SAM dump, and GPO abuse to Domain Admin.

Hard

#ssti
#jinja2
#active directory
+8

Oct 2, 2026/8 min read

Forensics

Assumed-breach, OSCP-style AD lab (DC + 2 member servers). Targeted Kerberoasting, a cracked Access database, and a service misconfiguration lead to SYSTEM. A DA ticket left behind on a forensics box finishes it with DCSync.

Medium

#assumed breach
#active directory
#targeted kerberoasting
+10

Writeups

Orion

Odyssey

Forensics