Voleur is a medium Windows box simulating an assumed-breach with low-priv user creds. Crack an encrypted Excel to get creds, use WinRM via password-spraying and DACL abuse, restore an AD user from Recycle Bin, decrypt DPAPI to extract an SSH key for WSL, access mounted `C:\` as root to dump NTDS backups and parse NTDS to obtain a Domain Administrator shell.

Walkthrough of the HTB Puppy machine: starting with levi.james, the tester abuses HR’s GenericWrite to join DEVELOPERS, accesses a DEV SMB share, cracks a KeePass DB, and sprays creds to gain ant.edwards. Using SENIOR DEVS’ GenericAll, they activate adam.silver, find backups revealing steph.cooper creds, decrypt DPAPI data, and escalate to admin.