04 — Windows beginner labs
Tier A — Starting Point
| Order | Machine | Focus |
| 1 | Dancing | SMB shares |
| 2 | Explosion | RDP / weak auth |
| 3 | Archetype | SMB + MSSQL → shell → local creds (core) |
Tier B — Easy host
| Order | Machine | Focus |
| 4 | Legacy or Blue | Classic SMB vuln (pick available) |
| 5 | Bastion | Backups / VHD / cred recovery |
| 6 | Markup / Access / Love | Easy Windows when in rotation |
Skip early
Making custom payloads the whole lesson; older kernel→SYSTEM as the first privesc class; Responder chains that need a web foothold before friends understand SMB.
Per-box checklist
- Foothold service?
- Local enum find that mattered?
- Admin/SYSTEM via misconfig or vuln — one sentence why.