Active easy windows ✓ ▶ Remote execution (WinRM, PsExec, WMI) (root) SMB/NFS enumeration GPP and GPO abuse Domain LDAP/RPC enumeration Kerberoasting Remote execution (WinRM, PsExec, WMI) Hash cracking
Cicada easy windows ✓ ▶ Remote execution (WinRM, PsExec, WMI) (user) Domain LDAP/RPC enumeration SMB/NFS enumeration Password spraying and valid users Credentials in files Remote execution (WinRM, PsExec, WMI) SeBackup / SeRestore SAM/LSA/LSASS dumping
Crafty easy windows ✓ ▶ Remote execution (WinRM, PsExec, WMI) (root) Public CVE exploitation Credentials in files Remote execution (WinRM, PsExec, WMI) Reverse engineering
Driver easy windows ✓ ▶ Remote execution (WinRM, PsExec, WMI) (foothold) Default credentials NTLM capture and relay Remote execution (WinRM, PsExec, WMI) Hash cracking Public CVE exploitation Windows exploits
Eighteen easy windows ✓ ▶ Remote execution (WinRM, PsExec, WMI) (foothold) Domain LDAP/RPC enumeration Password spraying and valid users MSSQL abuse Remote execution (WinRM, PsExec, WMI) Hash cracking BadSuccessor (dMSA) Pass-the-hash / ticket Internal services and port forwarding
Forest easy windows ✓ ▶ Remote execution (WinRM, PsExec, WMI) (foothold) Domain LDAP/RPC enumeration AS-REP roasting Password spraying and valid users Remote execution (WinRM, PsExec, WMI) Hash cracking Privileged Windows groups ACL abuse (BloodHound) DCSync Pass-the-hash / ticket
Heist easy windows ✓ ▶ Remote execution (WinRM, PsExec, WMI) (foothold) Domain LDAP/RPC enumeration Password spraying and valid users Remote execution (WinRM, PsExec, WMI) Hash cracking Memory dumps
Mailing easy windows ✓ ▶ Remote execution (WinRM, PsExec, WMI) (user) LFI / path traversal Credentials in files Phishing and malicious documents NTLM capture and relay Remote execution (WinRM, PsExec, WMI) Public CVE exploitation
Nest easy windows ✓ ▶ Remote execution (WinRM, PsExec, WMI) (root) SMB/NFS enumeration Password spraying and valid users Credentials in files Reverse engineering Remote execution (WinRM, PsExec, WMI)
Sauna easy windows ✓ ▶ Remote execution (WinRM, PsExec, WMI) (foothold) AS-REP roasting Password spraying and valid users Remote execution (WinRM, PsExec, WMI) Hash cracking Credentials in the registry and history ACL abuse (BloodHound) DCSync Pass-the-hash / ticket
Timelapse easy windows ✓ ▶ Remote execution (WinRM, PsExec, WMI) (foothold) SMB/NFS enumeration Remote execution (WinRM, PsExec, WMI) Hash cracking Backups and archives Credentials in the registry and history Reading LAPS passwords
Arkham medium windows ✓ ▶ Remote execution (WinRM, PsExec, WMI) (user) SMB/NFS enumeration Insecure deserialization Hash cracking Credentials in files Remote execution (WinRM, PsExec, WMI) Backups and archives DLL hijacking UAC bypass
Cascade medium windows ✓ ▶ Remote execution (WinRM, PsExec, WMI) (user) Domain LDAP/RPC enumeration SMB/NFS enumeration Credentials in the registry and history Remote execution (WinRM, PsExec, WMI) Weak or homemade cryptography Privileged Windows groups Deleted AD objects Reverse engineering
Certified medium windows ✓ ▶ Remote execution (WinRM, PsExec, WMI) (root) ACL abuse (BloodHound) Shadow Credentials ADCS (certificates) Remote execution (WinRM, PsExec, WMI)
Escape medium windows ✓ ▶ Remote execution (WinRM, PsExec, WMI) (user) SMB/NFS enumeration NTLM capture and relay Credentials in files MSSQL abuse Hash cracking Remote execution (WinRM, PsExec, WMI) Log analysis ADCS (certificates) Pass-the-hash / ticket
Fuse medium windows ✓ ▶ Remote execution (WinRM, PsExec, WMI) (user) Password spraying and valid users Domain LDAP/RPC enumeration Remote execution (WinRM, PsExec, WMI) Other token privileges
Jab medium windows ✓ ▶ Remote execution (WinRM, PsExec, WMI) (user) AS-REP roasting Password spraying and valid users Hash cracking ACL abuse (BloodHound) Remote execution (WinRM, PsExec, WMI) Malicious file upload Internal services and port forwarding
Logging medium windows ✓ ▶ Remote execution (WinRM, PsExec, WMI) (user) SMB/NFS enumeration Log analysis DLL hijacking Scheduled tasks and admin scripts ACL abuse (BloodHound) gMSA accounts Remote execution (WinRM, PsExec, WMI) ADCS (certificates) WSUS abuse
Monteverde medium windows ✓ ▶ Remote execution (WinRM, PsExec, WMI) (user) Domain LDAP/RPC enumeration Password spraying and valid users SMB/NFS enumeration Credentials in files Remote execution (WinRM, PsExec, WMI) Privileged Windows groups MSSQL abuse
POV medium windows ✓ ▶ Remote execution (WinRM, PsExec, WMI) (user) Vhost and subdomain fuzzing IIS and ASP.NET Insecure deserialization LFI / path traversal Credentials in files Remote execution (WinRM, PsExec, WMI) Other token privileges
Puppy medium windows ✓ ▶ Remote execution (WinRM, PsExec, WMI) (user) SMB/NFS enumeration ACL abuse (BloodHound) Password spraying and valid users Hash cracking Credentials in files Remote execution (WinRM, PsExec, WMI) Backups and archives Saved credentials / DPAPI
Resolute medium windows ✓ ▶ Remote execution (WinRM, PsExec, WMI) (foothold) Domain LDAP/RPC enumeration Password spraying and valid users Remote execution (WinRM, PsExec, WMI) Credentials in the registry and history Privileged Windows groups
SolarLab medium windows ✓ ▶ Remote execution (WinRM, PsExec, WMI) (user) SMB/NFS enumeration Public CVE exploitation Password spraying and valid users Credentials in files Password reuse Remote execution (WinRM, PsExec, WMI) Authentication bypass Internal services and port forwarding Weak or homemade cryptography
Voleur medium windows ✓ ▶ Remote execution (WinRM, PsExec, WMI) (user) Credentials in files Hash cracking Saved credentials / DPAPI ACL abuse (BloodHound) Deleted AD objects Kerberoasting Remote execution (WinRM, PsExec, WMI) SAM/LSA/LSASS dumping
Worker medium windows ✓ ▶ Remote execution (WinRM, PsExec, WMI) (user) Vhost and subdomain fuzzing CI/CD and build abuse Git history Password spraying and valid users Remote execution (WinRM, PsExec, WMI) SeImpersonate / Potatoes Internal services and port forwarding
Acute hard windows ✓ ▶ Remote execution (WinRM, PsExec, WMI) (foothold) Password spraying and valid users Remote execution (WinRM, PsExec, WMI) AV and EDR evasion Password reuse SAM/LSA/LSASS dumping AppLocker and Constrained Language Mode Hash cracking Scheduled tasks and admin scripts ACL abuse (BloodHound)
Blackfield hard windows ✓ ▶ Remote execution (WinRM, PsExec, WMI) (user) SMB/NFS enumeration AS-REP roasting Password spraying and valid users ACL abuse (BloodHound) Remote execution (WinRM, PsExec, WMI) SAM/LSA/LSASS dumping Memory dumps SeBackup / SeRestore
Cerberus hard windows ✓ ▶ Remote execution (WinRM, PsExec, WMI) (user) LFI / path traversal Public CVE exploitation SUID binaries Credentials in files Internal services and port forwarding Remote execution (WinRM, PsExec, WMI)
Nanocorp hard windows ✓ ▶ Remote execution (WinRM, PsExec, WMI) (user) NTLM capture and relay Hash cracking ACL abuse (BloodHound) Remote execution (WinRM, PsExec, WMI) Public CVE exploitation
Napper hard windows ✓ ▶ Remote execution (WinRM, PsExec, WMI) (root) Vhost and subdomain fuzzing Credentials in files Internal services and port forwarding Remote execution (WinRM, PsExec, WMI) Reverse engineering Weak or homemade cryptography
Pirate hard windows ✓ ▶ Remote execution (WinRM, PsExec, WMI) (user) Domain LDAP/RPC enumeration Default credentials gMSA accounts Internal services and port forwarding Remote execution (WinRM, PsExec, WMI) Kerberos delegation (RBCD) NTLM capture and relay SAM/LSA/LSASS dumping
Reel2 hard windows ✓ ▶ Remote execution (WinRM, PsExec, WMI) (user) Phishing and malicious documents NTLM capture and relay Password spraying and valid users Hash cracking Credentials in the registry and history Remote execution (WinRM, PsExec, WMI) AppLocker and Constrained Language Mode LFI / path traversal
RustyKey hard windows ✓ ▶ Remote execution (WinRM, PsExec, WMI) (user) Hash cracking DLL hijacking ACL abuse (BloodHound) Remote execution (WinRM, PsExec, WMI) Kerberos delegation (RBCD)
Scepter hard windows ✓ ▶ Remote execution (WinRM, PsExec, WMI) (user) SMB/NFS enumeration Hash cracking ACL abuse (BloodHound) ADCS (certificates) Remote execution (WinRM, PsExec, WMI) DCSync
Vintage hard windows ✓ ▶ Remote execution (WinRM, PsExec, WMI) (user) Default credentials gMSA accounts Saved credentials / DPAPI ACL abuse (BloodHound) Kerberoasting Password spraying and valid users Remote execution (WinRM, PsExec, WMI) DCSync Kerberos delegation (RBCD)
Absolute insane windows ✓ ▶ Remote execution (WinRM, PsExec, WMI) (user) Domain LDAP/RPC enumeration Metadata and OSINT AS-REP roasting Password spraying and valid users SMB/NFS enumeration ACL abuse (BloodHound) Shadow Credentials Remote execution (WinRM, PsExec, WMI) Traffic analysis (pcap) NTLM capture and relay
HackBack insane windows ✓ ▶ Remote execution (WinRM, PsExec, WMI) (foothold) Command injection Default credentials Internal services and port forwarding Remote execution (WinRM, PsExec, WMI) Other token privileges Scheduled tasks and admin scripts AV and EDR evasion Misconfigured services
Multimaster insane windows ✓ ▶ Remote execution (WinRM, PsExec, WMI) (foothold) API enumeration Domain LDAP/RPC enumeration SQL injection Remote execution (WinRM, PsExec, WMI) Hash cracking ACL abuse (BloodHound) AS-REP roasting Credentials in files AV and EDR evasion Misconfigured services Windows exploits
Sizzle insane windows ✓ ▶ Remote execution (WinRM, PsExec, WMI) (foothold) SMB/NFS enumeration NTLM capture and relay Remote execution (WinRM, PsExec, WMI) Hash cracking AppLocker and Constrained Language Mode DCSync Kerberoasting