windows

Phantom is a Windows machine running Active Directory. Guest authentication over SMB makes it possible to enumerate shares and recover an…

Analysis is a Windows machine running Active Directory. An internal subdomain hosts a webpage vulnerable to LDAP injection, which can be…

Cicada is a Windows machine running Active Directory with an open SMB share that contains a default password. Usernames can be enumerated by…

EscapeTwo is a Windows machine running Active Directory. The box starts with a set of given credentials, which can be used to enumerate SMB…

Administrator is a Windows machine running Active Directory. The box starts with a given set of credentials, which can be used to gather…

Axlle is a Windows machine running Active Directory. A hosted website displays a maintenance notice, but also mentions that outstanding…

Object is a Windows machine running Active Directory. Access to a Jenkins instance allows for triggering builds that execute batch commands…

Aero is a Windows machine hosting a website that allows users to upload custom Windows 11 themes. Due to a known RCE vulnerability in…

Jab is a Windows machine running Active Directory with an XMPP server that allows open registration. Once an account has been created, a…

Manager is a Windows machine running Active Directory. After gathering a list of domain users by brute-forcing RIDs, one of the users is…

Blackfield is a Windows machine running Active Directory. A list of potential usernames can be created based on user directories found in an…

Reel is a Windows machine running Active Directory with an open FTP server that contains a few documents, one of which reveals an email…

Escape is a Windows machine running Active Directory with an open SMB share containing credentials for an MSSQL instance. After connecting…

Scrambled is a Windows machine running Active Directory. A username can be found on a hosted webpage as well as a message indicating that…

Cascade is a Windows machine running Active Directory. An anonymous LDAP bind allows for enumeration of the environment, leading to the…

Monteverde is a Windows machine with an Active Directory environment featuring Azure AD. After enumerating domain users, it can be…

Resolute is a Windows machine running Active Directory. A few different methods can be used to enumerate users on the system and reveal an…

VulnNet: Active is a Windows machine running Active Directory with an instance of Redis that doesn't require authentication. This can be…

Timelapse is a Windows machine running Active Directory with an open SMB share that contains a password-protected ZIP archive. The password…

Blue is a Windows machine running SMB. A scan with Nmap can reveal that the box is vulnerable to EternalBlue, an exploit that targets a flaw…

Return is a Windows machine running Active Directory. A webpage featuring a printer admin panel can be leveraged to reveal LDAP credentials…

Sauna is a Windows machine featuring an Active Directory environment. A list of potential usernames can be generated based on a webpage that…

Active is a Windows machine running Active Directory with an open SMB share that contains an encrypted GPP (Group Policy Preferences…

Forest is a Windows machine running Active Directory. An anonymous LDAP bind allows for enumeration of the system which can be leveraged to…

Authority is a Windows machine running Active Directory that has an open SMB share containing ansible vault encrypted credentials. Once…