HackTheBox: Jeeves
A standalone Windows box: an open Jenkins instance on a high port runs a Groovy script for a shell as kohsuke, a cracked KeePass database yields an NTLM hash, Pass-the-Hash gives Administrator, and the root flag hides in an NTFS alternate data stream.
Read 