Index

Writeups

Step-by-step walkthroughs of retired machines and challenges. Filter by platform, difficulty, OS or technique — or just start typing.

1 / 1

Platform

Difficulty

Oct 17, 2026/8 min read

Orion

Two-machine Active Directory lab: NTLM theft from a writable share, Kerberoasting, BloodHound ACL abuse with shadow credentials, and ADCS ESC1 to Domain Admin.

Easy

#active directory
#smb
#ntlm theft
+5