Voleur is a medium Windows box simulating an assumed-breach with low-priv user creds. Crack an encrypted Excel to get creds, use WinRM via password-spraying and DACL abuse, restore an AD user from Recycle Bin, decrypt DPAPI to extract an SSH key for WSL, access mounted `C:\` as root to dump NTDS backups and parse NTDS to obtain a Domain Administrator shell.

A full writeup of the HTB TombWatcher machine, covering a multi-stage AD privilege-escalation path. Starting from user access, it chains WriteSPN abuse, GMSA password extraction, shadow credentials, OU control, tombstone restoration, and finally an ESC15 ADCS exploit to forge an Administrator certificate and gain system compromise.

Walkthrough of the HTB Puppy machine: starting with levi.james, the tester abuses HR’s GenericWrite to join DEVELOPERS, accesses a DEV SMB share, cracks a KeePass DB, and sprays creds to gain ant.edwards. Using SENIOR DEVS’ GenericAll, they activate adam.silver, find backups revealing steph.cooper creds, decrypt DPAPI data, and escalate to admin.