Puppy is another amazing assumed breach active directory box.
Fluffy is an easy Windows machine where initial credentials and CVE-2025-24071 lead to further user access, Active Directory enumeration, and ultimately Administrator compromise.
Shibuya is a hard Windows machine that requires extensive enumeration across multiple services and accounts. The attack chain involves exploiting exposed protocols, credential discovery, and lateral movement. Privilege escalation is achieved through abusing Active Directory Certificate Services.
