The description states:  "CrackMapExec (a.k.a CME) is a post-exploitation tool that helps automate assessing the security of large Active Directory networks. Built with stealth in mind, CME follows the concept of "Living off the Land": abusing built-in Active Directory features/protocols to achieve it's functionality and allowing it to evade most endpoint protection/IDS/IPS solutions."

This is one of those tools that I've used from time to time when another one of my tools wasn't doing what I wanted it to do.  That happened recently and I decided to make a big cheat sheet with a list of commands.  The following is a subset,  the basics, and if you're not familiar with this tool, it might be worth exploring.

In the real world, systems have endpoint protection installed and a lot of the tools we'd like to drop on the system will get detected.  Loading in memory is definitely an option but let's say we want to drop some tools onto the file system.  One option is to look at what is installed to hopefully find a product that has endpoint exclusions.  For example, Desktop Central from Manage Engine requires exclusions and if we can use that directory for our files, we can evade endpoint protection.

For our test, we're going to use the EICAR test file.  Some background in case you're unfamiliar with this test file:  ' The European Institute for EICAR developed the EICAR antimalware test file. The EICAR test file is a legitimate DOS program that is detected as malware by antivirus software. When the test file runs successfully (if it is not detected and blocked), it prints the message "EICAR-STANDARD-ANTIVIRUS-TEST-FILE!". ' 

The description states:  "This boot to root VM is fully a real life based scenario. It has been designed in way to enhance user's skills while testing a live target in a network. Its a quite forward box but stay aware of rabbit holes." 

There are quite a few directions this could have gone and I'm not sure I took the intended route, especially with the entry.  I feel like I found my foothold and just plowed on through it.  In general, I would say this is an easy box but you need the skills to setup an application outside of the vulnerable machine to use in my exploitation route.  That will make more sense shortly.