Phase 1: Securing CPTS Flag 1 (External Perimeter & Foothold)

Your engagement starts from a black-box external perspective. Securing CPTS Flag 1 requires you to bypass perimeter defenses and gain your initial foothold on a web-facing server.

• Aggressive Reconnaissance: Standard Nmap scans are just the beginning. To find the path to CPTS Flag 1, you must perform deep virtual host (VHost) fuzzing to uncover hidden applications that the simulated company forgot to secure.
• Vulnerability Chaining: You will rarely find a simple click-to-exploit CVE. Securing CPTS Flag 1 usually involves chaining an information disclosure or Server-Side Request Forgery (SSRF) flaw with an administrative file upload to execute a web shell.
• Privilege Escalation: Gaining a low-privileged shell (`www-data` or `IIS AppPool`) is not enough. You must run local enumeration (using tools like WinPEAS or LinPEAS) to escalate to an Administrator or root user to read the text file containing CPTS Flag 1.

Pro Tip: If you are struggling with web application attack chains, reviewing premium CPTS writeups can show you exactly how these vulnerabilities interact in the HTB environment.

Phase 2: Capturing CPTS Flag 2 (Internal Pivoting & Lateral Movement)

Once you own the perimeter machine, the game completely changes. The target for CPTS Flag 2 is hidden deep inside the internal network, completely inaccessible from your Kali or Parrot attacking machine.

To capture CPTS Flag 2, you must build a network pivot. Using tools like Ligolo-ng or Chisel, you will create a tunnel through your compromised Flag 1 machine to scan the internal subnets. The hunt for CPTS Flag 2 usually involves:

• Discovering internal infrastructure tools, such as Jenkins servers, GitLab instances, or unprotected internal databases.
• Reusing passwords or hashes recovered from the perimeter machine to authenticate to internal services.
• Gaining RCE on a secondary internal server, which holds CPTS Flag 2 and serves as your launchpad for Active Directory attacks.

Phase 3: Grabbing CPTS Flag 3 (Initial Active Directory Compromise)

With your internal pivot established, it is time to attack the Windows domain. Securing CPTS Flag 3 means you have successfully mapped the Active Directory environment and compromised your first set of domain credentials.

Capturing CPTS Flag 3 is highly dependent on your AD enumeration skills:

• BloodHound Analysis: Run SharpHound through your pivot to ingest the domain data. Look for shortest paths to high-value targets.
• Identity Attacks: To get CPTS Flag 3, look for misconfigured service accounts. Execute Kerberoasting and AS-REP Roasting to extract offline hashes, crack them with Hashcat, and move laterally to standard domain workstations.
• SMB and WinRM: Use tools like CrackMapExec (or NetExec) to validate your newly acquired credentials across the network until you locate and secure CPTS Flag 3.

Because AD environments can be overwhelming, having reliable CPTS dumps to reference can help you quickly identify which misconfigurations HTB specifically likes to implement in their labs.

Phase 4: Claiming CPTS Flag 4 & Total Domain Dominance

The final push is the hardest. CPTS Flag 4 tests your elite knowledge of Active Directory infrastructure, architecture flaws, and cross-domain trusts.

To claim CPTS Flag 4, you must escalate from a standard domain user to a Domain Admin or Enterprise Admin. This phase heavily features:

• Advanced Delegation Attacks: Exploiting Unconstrained Delegation, Constrained Delegation, or Resource-Based Constrained Delegation (RBCD).
• Active Directory Certificate Services (AD CS): Identifying vulnerable certificate templates (like ESC1 or ESC8) to instantly request a Domain Admin certificate.
• DCSync & Trust Exploitation: Once you have elevated privileges, perform a DCSync attack to dump the `NTDS.dit`. For environments with multiple domains, you will use these credentials to forge Golden Tickets and hop across forest trusts to secure CPTS Flag 4 and complete the technical portion of the exam.