LustrousTwo is a hard HackTheBox Windows machine where I use FTP to gather usernames, then spray with kerbrute and elpscrk to access an IIS site with Kerberos (IIS_KERBEROS_AUTH). By decompiling DLLs and abusing S4U2Proxy constrained_delegations, I achieve RCE and escalate via a Velociraptor server key.
Shibuya is a hard Windows machine that requires extensive enumeration across multiple services and accounts. The attack chain involves exploiting exposed protocols, credential discovery, and lateral movement. Privilege escalation is achieved through abusing Active Directory Certificate Services.
