I'm working on my dissertation for my bachelor's degree. I'm trying to create a framework which would make it possible to launch an entire virtual infrastructure, this would then be used to simulate a Red/Blue team assessment. I'm getting close to being finished, but need some vulnerabilities to implement for one of my scenarios. The current environment currently consists of 4 workstations (windows 10), 1 domain controller (server 2016), 1 file server (Server 2016 core) and a mail and web server (Linux).
Its relatively easy to find some basic vulnerabilities, but I rather implement something that would be consistent with a real-world scenario. Any of you have any tips on what vulnerabilities I could implement?