Metasploit

A Linux box modelling an industrial plant, where the privilege escalation is not a CVE but the plant’s own safety logic being fed a forged sensor reading. Unauthenticated Apache NiFi → operator SSH key in support-bundles → password-cracked PLC manual → anonymous OPC UA writes → CalibrationOffset ramped into the maintenance window → helix-maint-console → root.

A Windows box that falls to a known file-server vulnerability, then to a kernel-level privilege escalation. Rejetto HFS 2.3 RCE (CVE-2014-6287) for a foothold, then local exploit enumeration to SYSTEM.