How it went

1. 0
   nmap

   An nmap scan of the Windows host exposes SMB.

2. 1
   SMB share

   A readable Development share holds a .NET Encryptor app and an encrypted file.

3. 2
   AES time-brute

   DotPeek shows the app seeds its AES key and IV from a Unix timestamp; brute-forcing the file's SMB timestamps decrypts an archive holding a vault.

4. 3
   TOTP decrypt

   The vault's layered-AES authenticator secret is decrypted to generate the TOTP for s.blade's TeamCity login.

5. 4
   TeamCity RCE

   In TeamCity, a build patch run as a personal build executes a payload, returning a shell as the service account.

6. 5
   e.black

   That shell recovers e.black's plaintext password, giving an Evil-WinRM session and the user flag.

7. 6
   AD CS ESC1

   e.black can publish an ESC1-vulnerable certificate template; Certipy requests an Administrator certificate and its NTLM hash to log in as Administrator.