Mailing easy windows ✓ ▶ Phishing and malicious documents (user) LFI / path traversal Credentials in files Phishing and malicious documents NTLM capture and relay Remote execution (WinRM, PsExec, WMI) Public CVE exploitation
Checkpoint medium windows ✓ ▶ Phishing and malicious documents (user) ACL abuse (BloodHound) Deleted AD objects Password reuse Phishing and malicious documents BadSuccessor (dMSA) Pass-the-hash / ticket Memory dumps
Hospital medium windows ✓ ▶ Phishing and malicious documents (user) Malicious file upload Phishing and malicious documents Public CVE exploitation Kernel or system exploit Hash cracking
Outdated medium windows ✓ ▶ Phishing and malicious documents (foothold) Phishing and malicious documents Public CVE exploitation ACL abuse (BloodHound) Shadow Credentials WSUS abuse
Sniper medium windows ✓ ▶ Phishing and malicious documents (root) LFI / path traversal Remote file inclusion (RFI) AppLocker and Constrained Language Mode Credentials in files Phishing and malicious documents NTLM capture and relay Internal services and port forwarding
Axlle hard windows ✓ ▶ Phishing and malicious documents (foothold) Phishing and malicious documents Credentials in the registry and history ACL abuse (BloodHound) Scheduled tasks and admin scripts
Office hard windows ✓ ▶ Phishing and malicious documents (user) CMS exploitation Public CVE exploitation Password spraying and valid users Hash cracking Traffic analysis (pcap) Phishing and malicious documents Internal services and port forwarding Saved credentials / DPAPI GPP and GPO abuse
RE hard windows ✓ ▶ Phishing and malicious documents (foothold) SMB/NFS enumeration Phishing and malicious documents AV and EDR evasion Public CVE exploitation XXE Misconfigured services NTLM capture and relay Hash cracking
Reel hard windows ✓ ▶ Phishing and malicious documents (foothold) Metadata and OSINT Phishing and malicious documents Public CVE exploitation Credentials in files AppLocker and Constrained Language Mode ACL abuse (BloodHound)
Reel2 hard windows ✓ ▶ Phishing and malicious documents (foothold) Phishing and malicious documents NTLM capture and relay Password spraying and valid users Hash cracking Credentials in the registry and history Remote execution (WinRM, PsExec, WMI) AppLocker and Constrained Language Mode LFI / path traversal
Ethereal insane windows ✓ ▶ Phishing and malicious documents (user) Command injection Credentials in files Phishing and malicious documents
Mist insane windows ✓ ▶ Phishing and malicious documents (user) LFI / path traversal Public CVE exploitation AV and EDR evasion Hash cracking Phishing and malicious documents ADCS (certificates) DCSync gMSA accounts Kerberos delegation (RBCD) NTLM capture and relay Shadow Credentials SAM/LSA/LSASS dumping
Rabbit insane windows ✓ ▶ Phishing and malicious documents (user) CMS exploitation SQL injection Phishing and malicious documents Scheduled tasks and admin scripts
University insane windows ✓ ▶ Phishing and malicious documents (user) Public CVE exploitation Phishing and malicious documents Credentials in files Internal services and port forwarding gMSA accounts Kerberos delegation (RBCD) NTLM capture and relay