[!dashboard] Attack-flow navigation Dashboard: HTB Pentest Attack Flow
Section: 17 of 17 · Focus: Tool Index
Previous: Appendix — Worked Chains · Next: HTB Pentest Attack Flow
🧰 Tool Index — where each lives in the flow
Local attachments ship offline in attachments/ (integrity: SHA256SUMS (GPG signature)) — see the full inventory on the Dashboard. Everything else links to its canonical repo.
[!tip] One-liner install — the pip-side toolchain
# pipx keeps each tool's venv isolated (apt install pipx first) pipx install netexec impacket certipy-ad bloodyad pipx install git+https://github.com/dirkjanm/BloodHound.py.git@bloodhound-ce # bloodhound-ce-python # handy extras pipx install git+https://github.com/ShutdownRepo/targetedKerberoast.git || true # also ships in attachments/ sudo apt install -y seclists wordlists kerbrute feroxbuster enum4linux-ngGo binaries (kerbrute, fscan, gowitness, chisel, ligolo-ng agents) already ship in
attachments/— no build needed.
Quick-reference tables
Hash → hashcat mode (memorize for the exam)
| Material | Sample prefix | hashcat -m | john format |
|---|---|---|---|
| Kerberoast RC4 TGS | $krb5tgs$23$ | 13100 | krb5tgs |
| Kerberoast AES128 / AES256 | $krb5tgs$17$ / $18$ | 19600 / 19700 | krb5tgs |
| AS-REP roast | $krb5asrep$23$ | 18200 | krb5asrep |
| NetNTLMv2 (Responder/Inveigh) | user::DOMAIN:... | 5600 | netntlmv2 |
| NTLM (from DCSync/SAM) | 32-hex | 1000 | nt |
| MSSQL 2012+ | 0x0200... | 1731 | mssql12 |
GhostPack / SharpCollection family — which binary does what
| Binary (ships in attachments/) | Job | Stage |
|---|---|---|
| Rubeus.exe (SHA-256 · GPG signature) | Kerberos: roast, asktgt/asktgs, delegation, ticket inject | Stage 05 |
| Certify.exe (SHA-256 · GPG signature) | ADCS template/CA enum + ESC abuse | Stage 07 |
| Seatbelt.exe (SHA-256 · GPG signature) | Host situational awareness | Stage 09 |
| SharpUp.exe (SHA-256 · GPG signature) | Privesc misconfigs (C# PowerUp) | Stage 09 |
| SharpDPAPI.exe (SHA-256 · GPG signature) | DPAPI masterkeys / credential blobs | Stage 10 |
| SharpWMI.exe (SHA-256 · GPG signature) | WMI lateral movement | Stage 10 |
| SharpView.exe (SHA-256 · GPG signature) | C# PowerView port (AD enum) | Stage 04 |
[!warning] No official GhostPack releases These binaries come via the SharpCollection builds — verify each against SHA256SUMS (GPG signature) and expect AMSI/Defender to flag them (AMSI-bypass or obfuscate via donut_v1.1.zip (SHA-256 · GPG signature) shellcode only where authorized).
Pivot picker — which tunnel when
| Situation | Reach for | Why |
|---|---|---|
| Full TUN interface through one foothold | ligolo-ng (ligolo-ng_agent_windows_amd64.zip (SHA-256 · GPG signature)) | Real routes; nmap/nxc work natively, no proxychains |
| Quick SOCKS over one TCP stream, HTTP-friendly egress | chisel (chisel.exe (SHA-256 · GPG signature) / chisel_linux_amd64 (SHA-256 · GPG signature)) | Single binary, works through proxies/WAFs |
| SSH available on the pivot | sshuttle | No binary on target needed |
| Only DNS egress | dnscat2 / iodine | Last resort; slow |
Potato picker — SeImpersonate/SeAssignPrimaryToken → SYSTEM
| Target OS | First try | Fallback |
|---|---|---|
| Server 2016 / Win10 <1809 (or anything old) | JuicyPotato.exe (SHA-256 · GPG signature) | SweetPotato.exe (SHA-256 · GPG signature) |
| Server 2019/2022, Spooler running | PrintSpoofer64.exe (SHA-256 · GPG signature) | SweetPotato.exe (SHA-256 · GPG signature) |
| Server 2019/2022+, Spooler disabled | GodPotato-NET4.exe (SHA-256 · GPG signature) (.NET 4) or GodPotato-NET35.exe (SHA-256 · GPG signature) (.NET 3.5) | SweetPotato.exe (SHA-256 · GPG signature) (EfsRpc mode) |
[!tip] CPTS exam tip
whoami /privis the first command on any Windows foothold. SeImpersonatePrivilege + any potato = SYSTEM in under a minute; SeDebugPrivilege → mimikatz/procdump LSASS; SeBackupPrivilege → copy SAM/SYSTEM/ntds.dit.
[!tools] Modern toolchain (2026) — quick reference
cme→ NetExec (nxc) — CrackMapExec is legacy.- BloodHound Legacy → BloodHound CE + bloodhound-ce-python / RustHound-CE collectors.
- ADCS by hand → Certipy (
certipy-ad find -vulnerable) / on-host Certify.- Missing a Go binary? kerbrute, fscan, gowitness, chisel and ligolo-ng agents are already in
attachments/.
[!opsec] Before staging any attachment Every binary in
attachments/is signatured by modern AV/EDR (Rubeus, mimikatz, Snaffler especially). Verify hashes against SHA256SUMS (GPG signature), stage only on in-scope lab hosts, and delete artifacts on cleanup (Stage 11).
[!info] Companion notes
- Most-Used-Commands — the raw per-tool syntax reference this guide leans on.
- Attack-Flow-Guide — service-by-service enumeration playbooks + decision trees (built from the 0xdf CPTS-prep boxes).
- AD_Pentest_Tools_Cheat_Sheet — one-line summary of every AD tool.
- The AD-Attack category folders (#1–#78) are the exhaustive per-technique deep dives; this guide links the relevant one at each step.
[!abstract]
> USING_THISWork the spine (recon → enum → the AD stages), and every time loot drops a new credential, restart from STAGE 4 as that identity — new user = new BloodHound edges = new surface. Keep/etc/hostsand the clock in sync the whole way. Reverse every AD write you make (STAGE 6 OPSEC). Flags on HTB usually fall at foothold and DA; the stages between are the grind this playbook is for.Authorized HTB lab / CPTS practice only.
[!navigation] Continue the attack flow Previous: Appendix — Worked Chains
Dashboard: HTB Pentest Attack Flow
Next: HTB Pentest Attack Flow