Machine

YPuffy: enumerate the AD surface, abuse the exposed credential or delegation path, and escalate to Administrator.

Brains: use CVE-2024-27198 where it fits the service, gain a shell, and escalate to root.

Help: enumerate the AD surface, abuse the exposed credential or delegation path, and escalate to Administrator.

GoodGames: turn the exposed service into a shell, pivot through the container boundary, and escalate to root.

Valentine: use CVE-2014-0160 and CVE-2016-5195 where it fits the service, gain a shell, and escalate to root.

Yummy: enumerate the services, turn the exposed weakness into a shell, and escalate to root.

EvilCUPS: use CVE-2024-47076 and CVE-2024-47175 where it fits the service, gain a shell, and escalate to root.

Prioritise: enumerate the services, turn the exposed weakness into a shell, and escalate to root.

Pyrat: enumerate the services, turn the exposed weakness into a shell, and escalate to root.

Cicada: enumerate the AD surface, abuse the exposed credential or delegation path, and escalate to Administrator.

Gobox: enumerate the services, turn the exposed weakness into a shell, and escalate to root.

Bashed: enumerate the services, turn the exposed weakness into a shell, and escalate to root.

Shocker: use CVE-2014-6271 where it fits the service, gain a shell, and escalate to root.

TwoMillion: use CVE-2023-0386 where it fits the service, gain a shell, and escalate to root.

Soccer: enumerate the AD surface, abuse the exposed credential or delegation path, and escalate to Administrator.

GreenHorn: use CVE-2023-50564 where it fits the service, gain a shell, and escalate to root.

BoardLight: use CVE-2022-37706 and CVE-2023-30253 where it fits the service, gain a shell, and escalate to root.

Editorial: enumerate the services, turn the exposed weakness into a shell, and escalate to root.

PermX: use CVE-2023-4220 where it fits the service, gain a shell, and escalate to root.

Headless: enumerate the services, turn the exposed weakness into a shell, and escalate to root.

Trickster: use CVE-2023-47268 and CVE-2024-32651 where it fits the service, gain a shell, and escalate to root.

Sea: use CVE-2023-41425 where it fits the service, gain a shell, and escalate to root.

Caption: enumerate the services, turn the exposed weakness into a shell, and escalate to root.

Bastion: enumerate the AD surface, abuse the exposed credential or delegation path, and escalate to Administrator.

Curling: abuse the Joomla exposure for a shell, then use local enumeration to reach root.

Sightless: use CVE-2022-0944 and CVE-2024-34070 where it fits the service, gain a shell, and escalate to root.

Spooktrol: turn the exposed service into a shell, pivot through the container boundary, and escalate to root.

Writeup: use CVE-2022-41544 where it fits the service, gain a shell, and escalate to root.