I wonder if you could use something on the target’s network as an oracle. “This smart contract will pay out when presented with a Kerberos ticket signed by a target.example.com Active Directory server granting Domain Admin privileges.” (This particular formulation has some obvious holes, but you get the idea.)