Posts on: Methodology

---

A methodology is a decision loop, not a linear checklist. You gather facts, choose the cheapest action that could confirm or kill a hypothesis, record the result, and re-enter the loop. Phases below are named for orientation; in practice you drop back to enumeration every time something new appears — a share, a password, a hostname, a service banner. 2025–2026 context: This methodology is built for a landscape where identity is the new perimeter (OAuth, SAML, ADCS, cloud IAM), defenders automate containment (EDR, SOAR, automated account disabling), and exploits are increasingly deterministic (page-cache LPEs, parser differentials) rather than memory-corruption races. The loop is more important than ever: “Try harder” is not a strategy; “Read the source, check the clock, reuse the password” is.

Copy-paste command sheet for a general pentest or an OSCP-style exam: one block per phase, checkboxes for the steps, exact commands for the tool versions shipped on current distributions. It is the companion to the methodology — the methodology explains why and when, this page is what you actually type. Every command is a template: read it, substitute the variables, and check the precondition before running it. Version drift is the #1 cause of a “broken” cheat sheet. Recent tool releases changed flags in nxc, certipy, impacket, ligolo-ng, and hashcat. Before trusting a command: nxc --help, certipy <subcommand> -h, impacket-<tool> -h, hashcat --example-hashes. If your install predates mid-2026, several of the modules below (ADCS ESC17, nxc --ntds --use-vss, --remove-mic) will not exist.

A problem-first index of the recurring techniques that decide the boxes on the OSCP-like lab list. Each pattern is deliberately small: when to reach for it, the prerequisite check that must pass, the commands worth memorising, and the machines where it was the difference between stuck and rooted. It sits between three neighbours: the command checklist you run at the start of every box, the Linux, Windows and AD machine pages that walk one box end-to-end, and the “Cross-machine patterns” summary at the end of each machine page. This page is the layer that transfers: a technique is worth learning when you can name two machines it appears on and the condition that makes it fire. Nothing here is a walkthrough, and every command still needs its placeholders replaced.

One row per box for the whole OSCP-like list — 76 machines: 39 Linux, 18 Windows, 16 AD and 3 non-AD. Use it to pick a box by technique, to revise a path in 30 seconds, and to tick off what you have actually rooted. Detail lives in Linux, Windows and Active Directory; this page only routes you there. How to use this page Revision: read the row, then explain the path out loud without looking at the page. If you stall on the privesc cell, open the machine page. Progress: [ ] → [x] only when you rooted it unaided (no writeup, no hint). Reset a tick if you needed help. Choosing by technique: scan the Key tool or CVE and Privesc / path columns, not the names. The Study tracks below give ready-made orders. Gaps: the Coverage check shows which phase you have been avoiding — usually the one you keep skipping. Linux Machine Foothold Privesc / path Key tool or CVE Done Enigma NFS onboarding PDF OliveTin mysqldump break-out showmount · OpenSTAManager · CVE-2026-29782 [ ] Nibbles NibbleBlog plugin upload sudo writable monitor.sh CVE-2015-6967 · NibbleBlog [ ] Solidstate Apache James admin 4555 root cron /opt/tmp.py CVE-2015-7611 · Apache James 2.3.2 · pspy32 [ ] Poison LFI log poisoning VNC secret.zip → root vncpasswd · proxychains [ ] Editor XWiki Groovy RCE ndsudo PATH hijack CVE-2025-24893 · CVE-2024-32019 [ ] Sunday finger enum → SSH 22022 sudo wget hashcat 7400 · finger-user-enum [ ] Keeper Request Tracker default creds KeePass dump → PuTTY key CVE-2023-32784 · kpcli · RT root:password [ ] Pilgrimage .git → ImageMagick read binwalk PFS traversal CVE-2022-44268 · CVE-2022-4510 [ ] Cozyhosting Spring actuator session hijack sudo ssh ProxyCommand actuator/sessions · GTFOBins ssh [ ] Codify vm2 sandbox escape glob bypass → pspy vm2 3.9.16 · pspy [ ] Tartarsauce WordPress gwolle-gb RFI sudo tar → backuperer race wpscan · GTFOBins tar [ ] Jarvis UNION SQLi → phpMyAdmin SUID systemctl unit CVE-2018-12613 · sqlmap [ ] Tabby Tomcat manager WAR deploy lxd group mount manager-script · lxd [ ] Connected FreePBX pre-auth SQLi incron writable init.conf CVE-2025-57819 · incron [ ] Mentor SNMP community → admin JWT snmpd.conf cleartext → sudo snmpwalk · COPY PROGRAM [ ] Devvortex Joomla config leak apport-cli pager CVE-2023-23752 · CVE-2023-1326 [ ] Irked UnrealIRCd backdoor shell SUID viewuser /tmp/listusers UnrealIRCd 3.2.8.1 · steghide [ ] Popcorn upload Content-Type bypass PAM MOTD passwd write CVE-2010-0832 · DirtyCow [ ] Bashed /dev/phpbash.php webshell writable /scripts cron phpbash · pspy [ ] Broker ActiveMQ OpenWire exploit sudo nginx root config CVE-2023-46604 · nginx [ ] Silentium Flowise reset-token ATO Gogs symlink → root keys CVE-2025-58434 (ATO) · CVE-2025-59528 (RCE) · CVE-2025-8110 [ ] Networked backup.tar source leak cron filename injection AddHandler · changename.sh [ ] UpDown dev header → .git source sudo easy_install setup.py phar:// · easy_install [ ] Swagshop Magento admin object injection sudo vi wildcard shoplift · Magento 1.9 [ ] Nineveh type-juggling login → LFI port knock → chkrootkit phpLiteAdmin · CVE-2014-0476 [ ] Pandora SNMP args → internal SQLi SUID backup PATH hijack snmpbulkwalk · ltrace [ ] OpenAdmin OpenNetAdmin xajax injection internal vhost → sudo nano OpenNetAdmin 18.1.1 · sudo nano [ ] Precious PDFKit URL injection sudo ruby YAML.load CVE-2022-25765 · exiftool [ ] Busqueda Searchor eval() injection full-checkup CWD hijack Searchor 2.4.0 · docker-inspect [ ] Monitored SNMP args → Nagios token getprofile symlink zip CVE-2023-40931 · getprofile.sh [ ] BoardLight Dolibarr default creds Enlightenment SUID escape CVE-2023-30253 · CVE-2022-37706 [ ] Magic SQLi login → upload bypass SUID sysinfo PATH exif_imagetype · ltrace [ ] Help GraphQL credential leak kernel 4.4.0-116 LPE CVE-2017-16995 · GraphQL [ ] Editorial SSRF to internal API GitPython ext:: clone SSRF · GitPython ext:: [ ] Builder Jenkins CLI file read admin → root SSH key CVE-2024-23897 · jenkins-cli [ ] Linkvortex dev .git → Ghost CVE sudo clean_symlink env CVE-2023-40028 · git-dumper [ ] UnderPass SNMP → daloRADIUS panel sudo mosh-server snmpwalk · mosh-client [ ] Dog Backdrop .git → module upload sudo bee eval git-dumper · bee [ ] Cctv ZoneMinder SQLi tcpdump caps → motionEye CVE-2024-51482 · CVE-2025-60787 [ ] Windows Machine Foothold Privesc / path Key tool or CVE Done Markup default creds → XXE writable job.bat as SYSTEM XXE · icacls [ ] Jerry Tomcat default creds WAR deploys as SYSTEM Tomcat 7.0.88 · msfvenom [ ] Netmon anonymous FTP = C: drive PRTG notification injection PRTG · psexec [ ] Servmon NVMS-1000 path traversal NSClient++ 0.5.2.35 NSClient++ · 8443 tunnel [ ] Chatterbox AChat UDP overflow Alfred ACL → root.txt AutoRunScript · icacls [ ] Jeeves Jenkins no-auth console KeePass PTH → ADS KeePass · psexec -hashes [ ] Sniper LFI → session poisoning weaponized .chm Out-CHM · AppLocker [ ] Querier xlsm macros → MSSQL creds xp_dirtree → GPP cpassword olevba · GPP [ ] Giddy stacked SQLi xp_dirtree UniFi taskkill.exe hijack xp_dirtree · Ebowla [ ] Bounty IIS upload null byte SeImpersonate → LonelyPotato web.config · LonelyPotato [ ] Arctic ColdFusion FCKeditor upload MS10-059 kernel MS10-059 · exploit-suggester [ ] Remote NFS Umbraco.sdf XSLT RCE → TeamViewer AES Umbraco · TeamViewer 7 [ ] Buff Gym Management upload CloudMe overflow via Chisel Chisel · CloudMe 1.11.2 [ ] Love TLS cert vhost → SSRF AlwaysInstallElevated → SYSTEM AlwaysInstallElevated · msiexec [ ] Secnotes XSRF password reset SMB share → WSL history CSRF · WSL rootfs [ ] Access FTP mdb + PST cmdkey → runas /savecred runas /savecred · DPAPI [ ] Mailing traversal → hMailServer.ini CVE-2024-21413 → CVE-2023-2255 CVE-2024-21413 · CVE-2023-2255 [ ] Heist guest portal Cisco config Firefox dump → admin reuse Cisco type 7 · procdump [ ] Active Directory Machine Foothold Privesc / path Key tool or CVE Done Active anonymous Replication share GPP → Kerberoast Administrator gpp-decrypt · GetUserSPNs [ ] Forest null RPC → AS-REP roast WriteDacl domain → DCSync GetNPUsers · secretsdump [ ] Sauna kerbrute → AS-REP fsmith AutoLogon → GetChanges kerbrute · secretsdump [ ] Flight UNC include → NetNTLMv2 machine TGT → DCSync ntlm_theft · Rubeus tgtdeleg [ ] Return printer panel LDAP bind Server Operators binPath swap Responder · Server Operators [ ] Blackfield profiles share → AS-REP ForceChangePassword → SeBackup rpcclient setuserinfo2 · diskshadow [ ] Cicada guest SMB → HR note spray → reg save SAM netexec –rid-brute · reg save [ ] TheFrizz Gibbon LMS file write GPO abuse → SYSTEM CVE-2023-45878 · SharpGPOAbuse · hashcat 1420 [ ] Administrator assumed breach → BloodHound GenericAll chain → DCSync BloodHound · targetedKerberoast [ ] Monteverde querydispinfo → user spray ADSync LocalDB → DA ADSync · mcrypt.dll [ ] Escape SMB PDF creds → MSSQL coerce → ESC1 Certipy ESC1 · xp_dirtree [ ] EscapeTwo assumed breach → xlsx WriteOwner → ESC4 → ESC1 Certipy ESC4 · bloodyAD [ ] Certified assumed breach → WriteOwner shadow creds → ESC9 Certipy ESC9 · owneredit [ ] Puppy assumed breach → HR group KeePassXC → DPAPI KeePassXC · dpapi.py [ ] Timelapse null SMB zip → pfx cert WinRM → LAPS pfx2john · LAPS [ ] Signed assumed breach SQL login silver ticket → OPENROWSET ticketer.py · OPENROWSET [ ] Also on the list (not AD) Linux boxes that sit in the AD column of the source sheet but have no domain, no Kerberos and no BloodHound. They belong with the web → Linux privesc cluster.

Consolidated index of 39 OSCP-like HTB Linux boxes — one path per box, the non-obvious steps that decide it, and the exact commands worth memorising. These are edge-case notes, not walkthroughs: every command must be adapted to the target (IPs, vhosts, ports, usernames, payload paths), and the source writeup remains the walkthrough of record. Companion pages: Command Checklist · Pattern Library · Methodology · Machine Index. How to use this page Start with a full TCP scan plus the UDP ports people skip (161, and NFS/mountd on dynamic ports), then fuzz vhosts before directory-brute-forcing the IP root. Treat every credential as a username+password pair and spray it at SSH, su and the application itself before hunting another bug. After landing a shell, run the triad — sudo -l, SUID/capabilities, and pspy/cron/timers — plus ss -tnl for localhost-only services. When an exploit fails, read the application’s own source and config (.git, backups, *.inc.php, JAR/ZIP contents) before assuming the target is patched. Enigma Path: NFS export /srv/nfs/onboarding holds an onboarding PDF with webmail creds → Roundcube mail001 → password reuse to a second mailbox → OpenSTAManager 2.9.8 support portal → www-data → DB hash → haris → OliveTin on 1337 → root.

Eighteen standalone Windows boxes from the OSCP-like list — one intended path each, the non-obvious step that decides it, and the exact command worth memorising. These are edge-case notes, not walkthroughs: every IP, hostname, port, user and payload path must be adapted to the target, and the linked writeup remains the walkthrough of record. Companion pages: Command Checklist · Pattern Library · Methodology · Machine Index. How to use this page Full port scan, then UDP. nmap -sT -p- --min-rate 5000 --max-retries 1 is the baseline; several boxes answer on nothing in the top 1000 (Chatterbox, Arctic) and services hide on UDP (AChat on 9256). Enumerate SMB and RPC before attacking. Null sessions, share listings (smbclient -N -L //IP when smbmap fails), and RID cycling (lookupsids, 1000–1050) often produce the userlist no wordlist would give you. Re-try every credential against SMB, WinRM, RDP, MSSQL and the application itself — including username-format variants (admin vs admin@domain, user vs DOMAIN\user). Then run whoami /priv, check service ACLs and writable service paths before any kernel exploit. Assume Defender and AppLocker. Prefer living-off-the-land, shell_exec over system, staged and encoded payloads; a payload that does nothing is usually AV or .NET-version mismatch, not a broken exploit. Markup Path: Default creds on the MegaShopping login → Order page posts raw XML to /process.php → XXE reads Daniel’s id_rsa → SSH → users-writable job.bat run by a SYSTEM schedule.

The AD half of the OSCP-like HTB list — one path per box, the step that actually decides it, and the exact command worth memorising. These are edge-case notes, not walkthroughs: every IP, domain, user and path must be adapted to your target, and the linked writeup remains the walkthrough of record. Companion pages: Command Checklist · Pattern Library · Methodology · Machine Index. How to use this page Assumed breach vs unauthenticated. Only five boxes hand you credentials at the start — Administrator (olivia:ichliebedich), Certified (judith.mader:judith09), EscapeTwo (rose:KxEPkKe6R8su), Puppy (levi.james:KingofAkron2025!) and Signed (scott:Sm230#C5NatH). For those, the first ten minutes are --shares, BloodHound, certipy find and per-service auth checks — not brute force. Everything else starts with null SMB/RPC, a web bug, or a share. BloodHound before exploitation. Collect with bloodhound-python -c all --zip (or bloodhound-ce-python) and read the Abuse Info of each edge; rights on the domain node show up as GetChanges/GetChangesAll, not as an edge called “DCSync” (Sauna). Every found secret is a reuse test. Fan out nxc smb/ldap/winrm/mssql/ftp with --continue-on-success; a service that fails is not the service that matters (Return: WinRM but no SMB admin; Administrator: FTP but no WinRM for benjamin). Try the actual account name when a config spells it differently (Sauna). ADCS, delegation and time. None of Active/Forest/Sauna/Flight/Return/Blackfield/Cicada/TheFrizz/Administrator/Monteverde exposes a CA — do not burn exam minutes on Certipy there. The ESC paths live in Escape (ESC1), EscapeTwo (ESC4→ESC1) and Certified (ESC9). Clock skew is the single most common time sink: sudo ntpdate <dc fqdn>, expect the VPN to drop, reconnect — but note that AS-REP roasting tolerates hours of skew (Sauna). At-a-glance Box Start Entry technique Key escalation Difficulty Active Unauthenticated GPP cpassword in DFS-R share Kerberoast Administrator Easy Forest Unauthenticated Null RPC → AS-REP WriteDacl → DCSync Easy Sauna Unauthenticated Kerbrute → AS-REP AutoLogon → GetChanges/GetChangesAll Easy Flight Unauthenticated PHP LFI → UNC → NetNTLMv2 Machine TGT (tgtdeleg) → DCSync Hard Return Unauthenticated Printer panel → LDAP cleartext Server Operators sc config Easy Blackfield Unauthenticated Profiles share → AS-REP ForceChangePassword → LSASS → SeBackup Hard Cicada Unauthenticated Guest SMB → HR share → RID brute LDAP description → Backup Operators Easy TheFrizz Unauthenticated Gibbon LMS CVE-2023-45878 Kerberos SSH → GPO abuse Medium Administrator Assumed breach BloodHound ACL chain GenericAll → FTP psafe3 → targeted Kerberoast Medium Monteverde Unauthenticated RPC querydispinfo → spray ADSync LocalDB + mcrypt Medium Escape Unauthenticated SMB PDF → MSSQL Coerce → ESC1 Medium EscapeTwo Assumed breach xlsx → MSSQL sa WriteOwner → shadow creds → ESC4→ESC1 Medium Certified Assumed breach WriteOwner Management group Shadow creds ×2 → ESC9 Medium Puppy Assumed breach HR group → GenericWrite Developers KeePassXC → GenericAll → DPAPI Medium Timelapse Unauthenticated winrm_backup.zip → pfx Certificate WinRM → LAPS Easy Signed Assumed breach SQL login scott Silver ticket → OPENROWSET Medium Active Path: Anonymous SMB on the DFS-R Replication share → Groups.xml cpassword → gpp-decrypt → svc_tgs → Kerberoast (SPN owned by Administrator) → psexec.