Lab Field Manual

Worked examples from the OSCP-like HTB list, organised as a field manual rather than a walkthrough collection. The commands, patterns and methodology are generic pentesting material — OSCP is one application of them, not the frame.

The five layers

Layer	Use it when…	Page
Methodology	You need the order of operations, a decision gate, or the reporting structure	Pentesting Methodology
Command checklist	You know what to do and need the exact command with placeholders	Command Checklist
Pattern library	You need to recognise a situation and choose a technique	Pattern Library
Machine index	You want to revise, tick off rooted boxes, or pick a box by technique	Machine Index
Machine pages	You are stuck on a specific box and want the non-obvious step	Linux · Windows · Active Directory

How to use this section

New target / new engagement: start with Methodology Phase 0–2, run the pre-flight, and keep the command checklist open.
Stuck mid-box: skim the pattern library phase for your situation (foothold, privesc, AD), then open the matching machine entry.
Revising: use the machine index — read the row, explain the path aloud, then check the machine page.
After rooting: add the technique to your notes and update the machine’s Done tick. If you found a new edge case, add it to the machine page under the same structure (Path / Edge cases / Commands / Notes).

Machine pages at a glance

Page	Scope	Machines
Linux	Standalone Linux boxes	39
Windows	Standalone Windows boxes	18
Active Directory	AD sets, assumed-breach chains, plus 3 non-AD boxes	16 (+3)
Machine Index	One-line path + tool/CVE for every box, with study tracks	76

Recurring reflexes

Full port scan + UDP before service enumeration — footholds hide on 4555, 61616, 22022, 1337, 8765 and 161/udp.
Vhosts before directories — the IP root is often a decoy; a 403 is a finding.
Credential reuse across every service, including DB passwords, configs, .git history and mail.
Privilege escalation order: sudo -l → SUID/capabilities → cron/timers → groups → credentials → kernel.
Windows: whoami /priv → service ACLs → stored creds → token abuse → LSASS/SAM/NTDS → kernel.
AD: any account → BloodHound → Kerberos roast/ACL → delegation/ADCS → DCSync; sync the clock first.
Stage payloads when the target is Java/Groovy/PHP-FPM — pipes and quotes get mangled.
Record the failed path and why; that is what stops you repeating it under time pressure.

Sources and accuracy

Each machine entry ends with the writeup(s) used. Research was cross-checked against public writeups (0xdf, Ippsec, HackTricks, HTB official) and local tool versions where possible. Items that could not be verified are marked (unverified). If a box is retired, patched, or you find a better path, update the entry.

The machine list itself is maintained by Lainkusanagi; these pages annotate the HTB portion for study and general practice.