The Ultimate HTB CPTS Exam Guide: Conquering Flags 8, 9, and 12

The Hack The Box Certified Penetration Testing Specialist (CPTS) is widely regarded as one of the most brutal and realistic Active Directory exams in the industry. While grabbing the cpts first flag might feel straightforward, the internal network quickly spirals into a massive web of complex domain trusts and hardened lateral movement restrictions. If you are reading this, you have likely hit the notorious roadblocks deeper in the exam environment.

The CPTS Turning Point: Capturing Flag 8

The jump in difficulty leading up to cpts flag 8 is where most candidates fail. By this stage in the enterprise network, you are no longer dealing with simple misconfigurations. You have compromised initial endpoints, but now you must navigate restricted network segments using advanced pivoting tools like Chisel or Ligolo-ng.

Securing cpts flag 8 requires meticulous enumeration of Active Directory Certificate Services (AD CS) or deep misconfigurations in domain trusts. You must heavily utilize tools like BloodHound to map out non-standard administrative paths. Look closely for accounts susceptible to Kerberoasting or systems where you can abuse Resource-Based Constrained Delegation (RBCD) to force authentication and hijack elevated sessions.

Maintaining Momentum: The Path to Flag 9

Once you break the perimeter required for flag 8, you immediately face the challenge of cpts flag 9. The CPTS exam brilliantly chains these objectives, meaning the credentials or access tokens you acquired must be weaponized across different subnets.

• Cross-Forest Trust Abuse: CPTS flag 9 frequently tests your ability to forge inter-realm Golden Tickets or execute DCSync attacks to dump NTDS.dit hashes from a child domain.
• MSSQL Database Links: Do not ignore the database infrastructure. Finding a linked SQL server and utilizing `xp_cmdshell` to execute commands as a service account is a classic vector required to traverse deeper into the environment.

The Final Push: Isolating Flag 12

Reaching cpts flag 12 means you are knocking on the door of Enterprise Admin. The final hosts in the CPTS environment are heavily patched and monitored. To extract the flag, you must rely entirely on "Living off the Land" (LOLBins).

Dropping custom binaries will get you caught by the simulated AV solutions. Securing cpts flag 12 often involves abusing inherent Windows privileges (like SeImpersonatePrivilege or SeBackupPrivilege) or manipulating Group Policy Objects (GPOs) to push a hidden reverse shell directly to the core Domain Controller.