HTB Pentest Workflow — CPTS Cheat Sheets

[!dashboard] Workspace Sibling section: HTB Pentest Attack Flow — the end-to-end kill chain.

This section keeps six CPTS reference cards together: common services, common applications, Linux and Windows privilege escalation, web shells, and TTY/restricted-shell handling. Use them as focused lookups alongside the linear attack-flow playbook.

Source modules: 8 · Shells and Payloads · 11 · Attacking Common Services · 24 · Attacking Common Applications · 25 · Linux Privilege Escalation · 26 · Windows Privilege Escalation

[!warning] Authorized targets only Every command here is for engagements or labs where you hold explicit written permission. Record scope, timestamps, commands, and evidence as you work; prefer the least invasive test that proves the path.

Quick Setup

[!tip] Set the engagement context once Keep target details in the shell so commands stay readable and target mix-ups are less likely.

export IP="10.10.10.10"
export TARGET="target.htb"
export DOMAIN="inlanefreight.local"
export LHOST="10.10.14.2"
export U="username"
export P="password"
printf '%s\t%s\n' "$IP" "$TARGET" | sudo tee -a /etc/hosts

Where these fit in the kill chain

Section Index

Operator Toolkit — bundled attachments fas:Toolbox

Every binary and script below ships in this note’s attachments/ folder so the cards work offline. Stage them on your attack box, transfer with the methods in sheet 01, and clean up per each card’s opsec notes.

[!tip]+ Verify before you fire fas:Lightbulb Run sha256sum -c SHA256SUMS.txt against the bundle before staging anything — a corrupted or tampered binary wastes an engagement. Expect AV/EDR to flag every offensive tool here; plan obfuscation, in-memory execution, or exclusion-aware staging accordingly. If you ever need to re-download, pull originals only from the official GitHub releases:

• itm4n/PrintSpoofer
• peass-ng/PEASS-ng
• DominicBreuker/pspy
• jpillora/chisel
• nicocha30/ligolo-ng
• gentilkiwi/mimikatz
• SpecterOps/SharpHound
• PowerShellMafia/PowerSploit
• BeichenDream/GodPotato
• int0x33/nc.exe

Modern replacements ris:Refresh

Several tools named in older HTB modules and walkthroughs are deprecated or renamed. Map them before following an old writeup verbatim.

Progress

How to use these cards

• Fingerprint first. Don’t run a WordPress attack chain against Joomla, or MSSQL syntax against MySQL. Each card opens with a detection block.
• Misconfig before CVE. Default creds, anonymous auth, and exposed management interfaces land more boxes than memory-corruption CVEs — check those first.
• One target per command. Use the $IP/$TARGET vars so you never fire at the wrong host.
• Stage from the toolkit. The binaries and shells referenced across the cards are bundled above — verify hashes, then move them to target with the transfer primitives in sheet 01.
• Everything is loot. Config files, connection strings, and service accounts found here feed credential hunting and lateral movement.
• Choose the OS card after foothold. Begin with native, read-only enumeration; rank token/privilege and configuration paths before testing a kernel exploit.
• Treat shell quality as its own step. Validate a web shell carefully, then allocate and stabilize a PTY before commands that require prompts, signals or screen handling.

[!navigation] Jump in Services: 01 - Attacking Common Services - CPTS Cheat Sheet · Applications: 02 - Attacking Common Applications - CPTS Cheat Sheet · Linux PrivEsc: 03 - Linux Privilege Escalation - CPTS Cheat Sheet · Windows PrivEsc: 04 - Windows Privilege Escalation - CPTS Cheat Sheet · Web Shells: 05 - Web Shells - CPTS Cheat Sheet · TTY: 06 - TTY Upgrades and Restricted Shells - CPTS Cheat Sheet