I85PREP
⌘ K
HTB CPTS study materials
HTB CPTS study resources

HTB CPTS: Network and Service Exploitation (including Active Directory)

HTB CPTS · Work through your exam, one topic at a time.

All guide sections

Network and Service Exploitation (including Active Directory)

Network and Service Exploitation (including Active Directory)

This domain tests exploitation of exposed network services and Active Directory attack paths. CPTS emphasizes service enumeration, credential reuse, and AD misconfigurations rather than single-shot CVEs.

Core rules

  • Enumerate before exploiting: SMB signing and shares, LDAP anonymous bind, Kerberos pre-auth, WinRM, MSSQL, RDP, and NFS exports. Use nmap NSE, smbclient, rpcclient, ldapsearch, and NetExec/CrackMapExec.
  • In AD, collect domain data with valid credentials: BloodHound/SharpHound, PowerView, and impacket. Look for Kerberoastable SPNs, AS-REP roastable accounts, ACL edges such as GenericAll, WriteDACL, or ForceChangePassword, unconstrained delegation, and ADCS misconfigurations such as ESC1.
  • Escalate by path, not by tool. A Kerberoastable service account may be crackable; a GenericAll on a group may allow adding a user; an ADCS template may allow a certificate for domain admin.
  • Test access carefully: nxc smb for SMB, nxc winrm for WinRM, impacket-psexec or wmiexec for execution. Use --local-auth when testing local accounts.
  • Keep clock skew in mind for Kerberos; sync time or use faketime or ntpdate where allowed.

Worked example

You obtain low-privileged domain credentials from a web config. NetExec shows SMB signing not required on a member server. BloodHound reveals the user has GenericAll over the group Helpdesk. You add your user to Helpdesk, then use the inherited rights to read a service account SPN. You request a TGS with impacket-GetUserSPNs, crack it offline with hashcat mode 13100, and use the recovered password to WinRM to a server where that account is local admin. The reasoning is: valid creds, graph edge, group change, Kerberoast, crack, access.

Traps

Skipping BloodHound because 'there are no creds', mistaking a local admin for domain admin, ignoring ADCS, using a noisy exploit when a native command works, forgetting Kerberos clock skew, and not checking SMB signing before relay attempts.