HTB CAPE case studies
HTB CAPE · Put your knowledge to work in context.
CAPE (Certified Active Directory Pentesting Expert) is a vendor-issued practical certification from Hack The Box that tests whether you can attack a Windows Active Directory environment end to end, not just recite attack names. It suits penetration testers, red teamers, and SOC or blue team analysts who already work with AD daily and want an assessment that proves hands-on capability. The exam is practical: you are dropped into a multi-host AD estate, must enumerate, gain a foothold, escalate privileges, move laterally, and ultimately compromise the domain, then document the path in a professional report. Coverage tracks the full kill chain - fundamentals and enumeration, initial access, credential access and privilege escalation, lateral movement and pivoting, domain and forest compromise via Kerberos, ACL abuse and trusts, persistence and evasion, and remediation guidance. The HTB CAPE case studies are 5 cases and about 3,294 words.
1The Stale SRV Record and the Silent DC
You are on a Linux assessment host in a client's IT VLAN with no domain credentials. Scope is 10.10.20.0/24 and a 90-minute window before a change freeze.
637 words, about 3 min2The Workgroup Web Shell Behind an Egress Filter
During an authorized external test you obtain command execution as NT AUTHORITY on an internet-facing IIS server, WEB-DMZ-01, through a deserialization flaw. The host is workgroup-joined, sits in a DMZ, and has no domain credentials cached.
649 words, about 3 min3The SYSVOL Script With Server Local Admin
You have valid credentials for CORP 1, a low-privileged domain user, after a single password-spray attempt against the VPN portal. You have local administrator on WS-042, helpdesk1's workstation, but no domain admin.
671 words, about 3 min4The Dual-Homed Server With Only WinRM Open
You have local administrator on APP01, a dual-homed Windows Server 2019 host. NIC1 is on 10.10.10.0/24, the compromised staging network; NIC2 is on 10.20.20.0/24, a restricted server VLAN.
643 words, about 3 min5Child Domain Admin and the Parent SID History Ticket
You are a Domain Admin in the child domain eu.corp.local. The forest root is corp.local; parent and child are in the same forest, so SID filtering is not enabled between them.
694 words, about 3 min