How it went

1. 0
   nmap

   An nmap scan shows IIS and an SVN service.

2. 1
   SVN creds

   SVN history leaks nathen:wendel98 and a dimension.worker.htb Azure DevOps host.

3. 2
   DevOps webshell

   Committing an ASPX webshell and approving its pull request deploys it, giving a shell as the app pool.

4. 3
   robisl

   A svnrepos passwd file holds many credentials; only robisl has a home directory, so an Evil-WinRM login as robisl grabs the user flag.

5. 4
   build pipeline

   As robisl, a malicious build pipeline runs as SYSTEM, yielding the root flag.