Beginner-friendly Windows AD box: anonymous SMB enumeration leads to default credentials, password spraying finds a foothold, and SeBackupPrivilege escalates to Administrator via SAM dump.
windowsactive-directorysmbpassword-spraySeBackupPrivilegepass-the-hash