Kerberos

Pirate, a hard level Windows machine that throws you into a multi-segment Active Directory environment where every step forward requires digging deeper into how Windows authentication actually works and how to break it.

Scepter, a hard level Windows machine where two chained ADCS misconfigurations are the heart of the box, with some certificate cracking and BloodHound enumeration to set the stage.