Hard-rated Windows Active Directory box. Orchard CMS credentials are extracted from a MSSQL database found via connection string discovery. The MS14-068 Kerberos PAC forgery exploit elevates a low-privilege domain user directly to Domain Admin.

Insane-rated Windows Active Directory box. LLMNR/NBT-NS poisoning steals NTLM hashes via a writable SMB share. ADCS issues a certificate for PSRemoting access, Kerberoasting cracks a service account, and DCSync via replication rights yields domain admin hashes.