HTB CAPE study materials
HTB CAPE study resources

HTB CAPE case studies

HTB CAPE · Put your knowledge to work in context.

CAPE (Certified Active Directory Pentesting Expert) is a vendor-issued practical certification from Hack The Box that tests whether you can attack a Windows Active Directory environment end to end, not just recite attack names. It suits penetration testers, red teamers, and SOC or blue team analysts who already work with AD daily and want an assessment that proves hands-on capability. The exam is practical: you are dropped into a multi-host AD estate, must enumerate, gain a foothold, escalate privileges, move laterally, and ultimately compromise the domain, then document the path in a professional report. Coverage tracks the full kill chain - fundamentals and enumeration, initial access, credential access and privilege escalation, lateral movement and pivoting, domain and forest compromise via Kerberos, ACL abuse and trusts, persistence and evasion, and remediation guidance. The HTB CAPE case studies are 5 cases and about 3,294 words.

1

The Stale SRV Record and the Silent DC

You are on a Linux assessment host in a client's IT VLAN with no domain credentials. Scope is 10.10.20.0/24 and a 90-minute window before a change freeze.

637 words, about 3 min
2

The Workgroup Web Shell Behind an Egress Filter

During an authorized external test you obtain command execution as NT AUTHORITY on an internet-facing IIS server, WEB-DMZ-01, through a deserialization flaw. The host is workgroup-joined, sits in a DMZ, and has no domain credentials cached.

649 words, about 3 min
3

The SYSVOL Script With Server Local Admin

You have valid credentials for CORP 1, a low-privileged domain user, after a single password-spray attempt against the VPN portal. You have local administrator on WS-042, helpdesk1's workstation, but no domain admin.

671 words, about 3 min
4

The Dual-Homed Server With Only WinRM Open

You have local administrator on APP01, a dual-homed Windows Server 2019 host. NIC1 is on 10.10.10.0/24, the compromised staging network; NIC2 is on 10.20.20.0/24, a restricted server VLAN.

643 words, about 3 min
5

Child Domain Admin and the Parent SID History Ticket

You are a Domain Admin in the child domain eu.corp.local. The forest root is corp.local; parent and child are in the same forest, so SID filtering is not enabled between them.

694 words, about 3 min