Insane

PingPong is a brutally complex Insane-rated Windows box featuring a bidirectional forest trust, cross-realm Kerberos pivoting through a Hyper-V internal network, JEA ConstrainedLanguage bypass via XmlDocument XXE, and a multi-stage AD CS certificate abuse chain spanning two domains.

An Insane-rated Windows box chaining AngularJS CSTI, a subtle OAuth logical flaw, SQLite’s load_extension for DLL-based RCE, Edge DPAPI credential decryption, and .NET AppDomainManager injection to reach SYSTEM.