Machine Synopsis

`Logging` is a medium-difficulty Windows machine presented as an assumed-breach scenario, built around careful log review and a chain of Active Directory misconfigurations. Starting from a low-privileged domain account, enumeration reveals a world-readable `Logs` share, where a verbose error in an application trace leaks an outdated service-account password. Updating the year in the password to the current one allows authentication over Kerberos. The account is a member of the `Protected Users` group, and a fresh BloodHound collection reveals `GenericWrite` over a Managed Service Account. A `Shadow Credentials` attack recovers the MSA's NTLM hash and grants a `WinRM` foothold. From there, a scheduled task running under another user loads a DLL from a writable `ProgramData` location, allowing a DLL hijack to pivot to the `jaylee.clifton` user and the user flag. Finally, membership in the `IT` group grants `ESC17` enrollment rights over a certificate template intended for `WSUS`. Poisoning DNS, requesting a server-authentication certificate, and standing up a rogue `WSUS` server, lead to command execution as `SYSTEM` and the root flag.