How it went

1. 0
   nmap

   A full-port nmap scan points to an Icinga Web 2 instance on icinga.cerberus.local:8080.

2. 1
   Icinga traversal

   A path traversal in Icinga Web 2 reads its config from /etc/icingaweb2, leaking credentials.

3. 2
   Icinga RCE

   Those credentials log into Icinga, whose authenticated RCE (with a generated PEM key) returns a shell in a container.

4. 3
   Firejail SUID

   A vulnerable Firejail SUID binary escalates to root inside the container.

5. 4
   krb5.keytab

   The container turns out to sit on a Windows host; /etc/krb5.keytab yields Matthew's NTLM hash.

6. 5
   WinRM pivot

   A PowerShell port scan finds WinRM on the internal Windows host, reached through a Chisel tunnel.

7. 6
   WinRM spray

   The hash alone fails, so a WinRM password spray recovers Matthew's password for an Evil-WinRM shell.

8. 7
   ADSelfService+

   An ADSelfService Plus vulnerability, fired through a proxied Metasploit module, compromises the Windows host.