COMING SOONIntermediatePRO
JNDI to Domain Admin
An internet-facing VMware Horizon server takes a single poisoned HTTP header and hands a state-aligned actor a shell. From a Log4Shell JNDI callback, follow the chain through a disabled antivirus, a cryptominer with scheduled-task persistence, an LSASS credential dump, a rogue domain administrator, RDP to the domain controller, and an Ngrok reverse tunnel.
1h
8 tasks
50 points
ProLaunches in 4 days
Nov 17, 2026
View Pro plansTuesday, November 17, 2026 at 9:00 AM
Pro unlocks this operation at launch.
Training Tools
SIEMXDRFirewallQuery
What you'll investigate
8 objectives unlock when this operation goes live.
1Pinpoint the entry point
2Confirm code execution
3Expose the evasion step
4Unmask the persistence
5Catch the privilege grab
6Trace the move to the crown jewels
7Sever the durable channel
8Classify the initial access
Be first when it launches
Create your account and grab Pro before launch. The moment this operation goes live on Nov 17, 2026, you can jump straight in.
Get Started Free