HTB CAPE study plan
HTB CAPE · Give each week a clear focus.
8 weeks · About 7 hours per week
Active Directory Fundamentals and Enumeration
Build a two-VM lab (one Windows Server domain controller, one Windows 10/11 member host) and document the exact steps you used to promote the DC and join the client
Enumerate every object class in the domain with PowerView/BloodHound and label users, groups, computers, OUs, GPOs, and trusts on a hand-drawn domain map
Explain and demonstrate the difference between LDAP queries, SAMR enumeration, and NetBIOS/LLMNR name resolution by capturing each in Wireshark
Write down the default permission sets (AdminCount=1, protected users, Domain Admins vs. Enterprise Admins vs. Schema Admins) and where each is stored
Your checkpoint
A one-page domain map plus a lab build log with screenshots of the promoted DC, joined client, and a BloodHound graph of the domain
Active Directory Fundamentals and Enumeration & Initial Access and Foothold in AD Environments
Set up an attack host with the standard AD toolchain (Impacket, NetExec, BloodHound CE, Responder, Certipy) and verify each tool runs against the lab
Perform unauthenticated enumeration: SMB null sessions, LDAP anonymous binds, RID cycling, and DNS zone transfer attempts, recording which succeed and why
Run Responder and relay captured NTLMv2 hashes into a NetExec SMB relay against a host with SMB signing disabled, then document the signing requirement that made it work
Identify at least three misconfigurations that grant initial access (AS-REP roastable accounts, password spray targets from lockout policy, exposed services) and log them in a findings table
Your checkpoint
A findings table of at least five initial-access vectors with the exact command used, the evidence captured, and the root cause for each
Initial Access and Foothold in AD Environments & Credential Access and Privilege Escalation
Extract credentials from LSASS, SAM, and LSA secrets on the member host and explain which credential types each source yields
Crack at least two captured hashes offline with Hashcat and document the mode numbers and wordlists used
Execute a password spray that respects the domain lockout policy and record the exact threshold math you used
Perform an AS-REP roast and a Kerberoast against the lab, then crack one of each and note the account property that enabled each attack
Your checkpoint
A credential-access log with every recovered secret, its source, the cracking method, and the privilege level it unlocks
Credential Access and Privilege Escalation
Escalate from a standard user to local admin on the member host by abusing a misconfigured service, unquoted path, or writable ACL, and document the exact ACE or registry key
Use BloodHound to trace the shortest path from your owned user to Domain Admin and write down each edge in the chain
Explain and demonstrate the difference between a golden ticket, silver ticket, and diamond ticket by forging each against the lab and noting what validation each bypasses
Compare overpass-the-hash, pass-the-ticket, and pass-the-hash by executing each and recording what artifact each leaves in the event log
Your checkpoint
A privilege-escalation writeup showing one full chain from standard user to Domain Admin with the BloodHound path and the log evidence at each hop
Lateral Movement and Pivoting
Set up a pivot through a compromised host using a SOCKS proxy and reach an isolated second subnet from your attack host
Move laterally with at least three distinct techniques (PsExec/WMIC, WinRM, and SMB with a stolen hash) and note which service or port each relies on
Configure and use a reverse tunnel or port forward to reach a host that has no route from your attack machine
Document the firewall and network segmentation rules that would have blocked each lateral movement technique you used
Your checkpoint
A network diagram of the lab with every pivot, tunnel, and lateral movement path annotated with the ports and protocols used
Domain and Forest Compromise (Kerberos, ACL Abuse, Trusts)
Abuse at least three ACL-based attack paths (GenericAll, WriteDACL, ForceChangePassword, AddMember) and record the exact ACE that enabled each
Execute a DCSync and a DCShadow-style attack in the lab and explain which replication permissions each requires
Enumerate and exploit a domain trust by forging an inter-realm TGT and documenting the SID filtering boundary that limits it
Explain the Kerberos attack surface end to end: TGT/TGS flow, delegation types (unconstrained, constrained, RBCD), and how each is abused
Your checkpoint
A domain-compromise report covering one ACL abuse, one Kerberos delegation abuse, and one trust abuse, each with the prerequisite, the command, and the resulting access
Persistence and Defense Evasion in AD & Reporting and Remediation Guidance
Establish persistence via a golden ticket, a SID-history injection, and a malicious GPO, then verify each survives a reboot and a password reset
Evade detection by clearing or suppressing the specific event IDs your earlier attacks generated and note which events you could not hide
Draft a remediation section for each finding in your report that names the specific control, the setting, and the verification step
Map each finding to a severity and a business impact statement a non-technical stakeholder could act on
Your checkpoint
A full penetration-test report draft covering all findings from weeks 1-7 with an executive summary, technical findings, and a remediation table
Domain and Forest Compromise (Kerberos, ACL Abuse, Trusts) & Reporting and Remediation Guidance
Re-run the entire attack chain end to end in under four hours without notes, timing each phase
Complete a timed practice exam covering all seven domains and review every missed question against the source material
Peer-review your report for clarity, reproducibility, and remediation accuracy, and fix every gap found
Build a one-page quick-reference of the commands and concepts you were slowest on
Your checkpoint
A polished final report plus a timed full-chain run log showing each phase completed within its target window
Milestones
Week 2: You can build the lab from scratch and obtain an initial foothold with at least two independent techniques, each documented with evidence
Week 4: You can escalate from a standard domain user to Domain Admin using a BloodHound-identified path and explain every edge in the chain
Week 6: You can compromise the domain through an ACL abuse, a Kerberos delegation abuse, and a trust abuse without reference notes
Week 8: You complete the full attack chain end to end in under four hours and submit a report that passes peer review with no reproducibility gaps