While working through the PNPT material from TCM Security, specifically the Windows privilege escalation course, I kept hitting the same wall: the lab machines used in the course require a paid subscription.
I did not want to practice only when I could pay for lab time. So I rebuilt two of them from scratch and released both for free.
En0wn
A Windows machine built as a free alternative to Devel from Hack The Box. Same shape of problem: enumerate, get a foothold, escalate.
Good for:
- Windows privilege escalation
- PNPT preparation
- OSCP-style practice
- General Windows exploitation
Source and setup: github.com/enes-ismaili/En0wn
eNotes
The second one, built as a free alternative to SecNotes. Slightly wider scope, because SecNotes covers more than privilege escalation.
Good for:
- Web application testing
- CSRF and second-order SQL injection
- SMB enumeration and exploitation
- Windows privilege escalation through WSL
- PNPT and OSCP-style labs
Source and setup: github.com/enes-ismaili/eNotes
Why bother
Vulnerable labs are how you build the reflexes that matter under time pressure. If the only way to practice is a paid subscription, people practice less, and the community gets thinner.
Both labs are free to download and run. Feedback and corrections are welcome, and I would rather hear that an attack path is broken than have someone waste an evening on it.