Windows

Pirate, a hard level Windows machine that throws you into a multi-segment Active Directory environment where every step forward requires digging deeper into how Windows authentication actually works and how to break it.

Scepter, a hard level Windows machine where two chained ADCS misconfigurations are the heart of the box, with some certificate cracking and BloodHound enumeration to set the stage.

How Discord’s DLL search order can be abused to load attacker-controlled code. Covers DLL basics, cross-compiling from Linux with mingw64, procmon analysis, and dropping a rogue d3d12.dll.