HTB CAPE: Credential Access and Privilege Escalation

What this domain tests

Credential Access and Privilege Escalation tests harvesting secrets from memory, disk, and AD, then converting them into higher privilege. The exam rewards knowing which credential type you have, plaintext, NT hash, Kerberos ticket, or certificate, and which escalation path it unlocks.

Core rules and concepts

• secretsdump extracts SAM, LSA, and NTDS secrets; Mimikatz sekurlsa reads LSASS; Rubeus handles tickets; Certipy abuses AD CS.
• Check ACL rights: GenericAll, WriteDACL, ForceChangePassword, AddMember, and DCSync.
• AD CS ESC1 requires a template that allows enrollee-supplied subject and client authentication.
• Unconstrained delegation hosts can capture TGTs; constrained delegation can impersonate users to specific services.

Worked example

You have GenericAll on user svc-backup. Instead of resetting the password blindly, confirm whether that account has local admin on a server. If it does, reset it with Set-DomainUserPassword, then use the new credential to access that host. Reasoning: the ACL edge only matters if the target has sessions or privileges; correlate with BloodHound before changing anything. If the account is a service account, prefer shadow credentials over a reset to avoid breaking the service.

Traps that cost marks

• Resetting a service account password and breaking an application.
• Requesting an AD CS certificate with the wrong EKU or without enrolment rights.
• Dumping LSASS on an EDR-protected host without a plan.
• Ignoring gMSA and LAPS where readable passwords are intentionally not available.
• Escalating without first proving the new credential works.