HTB CPTS Walkthrough: Conquering Flags 1, 2, and 3

The Hack The Box Certified Penetration Testing Specialist (CPTS) exam is a grueling 10-day technical assessment that mirrors a real-world corporate penetration test. Before you can dominate the internal domain, you must successfully breach the external perimeter. Finding the cpts first flag and navigating through to Flags 2 and 3 requires a flawless external enumeration methodology and a firm grasp on basic Active Directory enumeration.

1. Breaking the External Perimeter (Flag 1)

Your assessment begins strictly from the outside. You are given a target scope, and your first objective is to locate and exploit a vulnerable web application or exposed service to capture cpts flag 1.

The Fuzzing Methodology

Relying on standard Nmap scans is not enough. You must aggressively fuzz for hidden virtual hosts (vhosts) and undocumented API directories. Candidates frequently fail to secure the cpts first flag because they do not utilize customized wordlists tailored to enterprise environments. When hunting for the initial web exploit, focus heavily on:

• Custom Web Applications: Look for SQL injection vectors in login panels or unauthenticated remote code execution (RCE) via insecure file uploads.
• Default Credentials: Never underestimate the presence of default administrative passwords left on commercial off-the-shelf (COTS) software portals.

2. Establishing the Internal Foothold (Flags 2 & 3)

Once you have a reverse shell on your initial target, the game immediately changes from web application hacking to internal network enumeration. Securing Flags 2 and 3 dictates that you map out the local machine and identify your position within the Active Directory forest.

Local Privilege Escalation & Domain Mapping

Your initial shell will likely be a low-privileged service account (e.g., www-data or NetworkService). To progress to the next phase, you must elevate your local privileges and extract domain credentials. Key techniques include:

• Configuration File Hunting: Search the local file system for cleartext database connection strings, unattended installation files, or registry keys containing saved credentials.
• Basic AD Reconnaissance: Utilize lightweight scripts to query the domain controller. You need to identify the domain name, the domain SID, and the list of active users to prepare for your lateral movement phase.