Explosion

Personal Rating: Very Easy

Anonymous RDP Logon

The first nmap scan revealed an RDP port to be open.

sudo nmap <IP>

Anonymous login was possible directly:

xfreerdp /v:10.129.187.48 /cert:ignore /u:Administrator

This was extremely easy, but you have to know that anonymous login might be possible to even attempt it.