Best Hack The Box machines to prepare for the OSCP
42 retired HTB machines to prepare for the OSCP+, ordered by difficulty: Linux, Windows and Active Directory, what each one teaches and a 10-week plan.
Preparing for the OSCP on Hack The Box works, but only if you pick the right boxes: many are too CTF-like (steganography, guessing games) and others are much harder than the exam. This list gathers 42 retired machines in the exam's style, ordered so each one adds something new, with what each teaches according to the PwnAtlas catalogue (which links every technique to the minute in IppSec's video where it is used).
What the exam looks like (OSCP+)
Since November 2024 the exam has this format:
| Part | Machines | Points |
|---|---|---|
| Standalone machines | 3 (Linux or Windows) | 20 each: 10 for initial access and 10 for privilege escalation |
| Active Directory | 1 domain with 3 hosts | 40, all or almost nothing. You start with a username and password (assumed breach) |
You pass with 70 out of 100 in 23 hours and 45 minutes, plus 24 hours for the report. There are no longer bonus points for the course exercises. In HTB terms: you need to solve an easy or medium box on your own in about 4 hours and compromise a small domain starting from one user.
Tip
What shows in the exam is not knowing lots of exploits but having a method. Use the recon checklist on every box in this list, starting with the nmap scan, and write down in your notes the exact command that gave you each foothold.
How to use this list
- No help first. Give each box at least 2 hours before looking at anything. If you get stuck, look only at the technique you are missing on the box's PwnAtlas page (not the whole writeup) and carry on.
- Then the video. Even if you solve it, watch IppSec's video: there is almost always another way or a trick you did not know.
- You need VIP. Retired machines are only available with the HTB VIP subscription (apart from a few free rotating ones). It is the legal way to practise: they are systems built to be attacked.
Easy Linux: the method
| Machine | What you learn |
|---|---|
| Nibbles | Find a hidden path, log into a CMS with weak credentials, upload a shell and abuse sudo on a script you can edit. The first one you should do. |
| Networked | A source code backup, file upload with a double extension, command injection in a scheduled task and sudo on a network script. |
| Blocky | Credentials inside a decompiled .jar and password reuse up to sudo. |
| OpenAdmin | A public OpenNetAdmin CVE, credentials in config files, port forwarding to an internal site and an encrypted SSH key. |
| Postman | Unauthenticated Redis to write your SSH key, cracking another user's key and a Webmin exploit. |
| Tabby | LFI to read tomcat-users.xml, deploying a WAR and abusing the lxd group. |
| Armageddon | Drupalgeddon2 (attacking CMSs), a hash pulled from MySQL and sudo snap. |
| Doctor | SSTI in a Flask app and passwords in logs thanks to the adm group. |
| Academy | Mass assignment to become admin, a Laravel CVE, credentials in a .env and sudo composer. |
| Busqueda | Injection in a Python library, credentials in a .git and a sudo script that calls another one by relative path. |
| Precious | A pdfkit CVE, credentials in the Bundler config and YAML deserialization with sudo. |
| Sau | SSRF to an internal service, an unauthenticated command injection and sudo systemctl. |
| Keeper | Default credentials, a KeePass memory dump and a PuTTY key converted to OpenSSH. |
Linux: one step further
| Machine | What you learn |
|---|---|
| Nineveh | Brute forcing a login, LFI chained with phpLiteAdmin and a vulnerable scheduled task. |
| Jarvis | Manual SQL injection up to phpMyAdmin, a sudo script with command injection and SUID systemctl. |
| Tartarsauce | A WordPress plugin with RFI, sudo tar and a backup task fooled with symbolic links. |
| Admirer | Credentials in forgotten files, reading files with your own MySQL server and Python library hijacking with sudo SETENV. |
| Valentine | Heartbleed to read server memory, an encrypted SSH key and a kernel exploit (or a root tmux session). |
| Irked | A backdoored IRC server and a custom SUID binary. |
Windows: from the web to SYSTEM
| Machine | What you learn |
|---|---|
| Jerry | Tomcat with default credentials and a malicious WAR. Your first Windows box. |
| Devel | Anonymous FTP that writes to the IIS web root, an .aspx web shell and a kernel exploit. |
| Optimum | An HttpFileServer CVE and Windows exploits found from the missing updates. |
| Bounty | Uploading a web.config that runs code on IIS and SeImpersonate with a Potato. |
| Love | An SSRF to read an internal service, file upload and AlwaysInstallElevated. |
| Remote | An NFS share with the Umbraco database, an authenticated CVE and a misconfigured service. |
| Netmon | Anonymous FTP over the whole disk, a password in a PRTG backup and its command injection. |
| ServMon | Path traversal in NVMS-1000, password spraying over SSH and NSClient++ through a tunnel. |
| Buff | A CVE in a PHP app and a CloudMe buffer overflow with port forwarding. |
| Access | An .mdb and an encrypted .zip from FTP, Telnet and saved credentials for runas /savecred. |
| Bastion | A virtual disk from a backup on SMB, dumping the SAM and passwords saved in mRemoteNG. |
| Heist | Passwords from a Cisco config, password spraying and a Firefox memory dump. |
| Chatterbox | A public AChat buffer overflow and autologon credentials in the registry. |
| Querier | Credentials in a macro, stealing the MSSQL hash with xp_dirtree (MSSQL attacks) and cached GPP. |
| Jeeves | The Jenkins script console, a KeePass database and pass-the-hash. |
| Driver | An .scf file on a share to capture an NTLM hash and PrintNightmare. |
Active Directory: the 40-point part
The exam domain starts with a username and password. These boxes cover what you need; the full explanation is in the list of best HTB machines to learn Active Directory.
| Machine | What you learn |
|---|---|
| Active | Passwords in GPP and your first Kerberoasting. |
| Forest | Users without credentials, AS-REP Roasting, BloodHound and an ACL chain to DCSync. |
| Sauna | Building usernames, AS-REP Roasting and autologon credentials. |
| Cicada | Password spraying and SeBackupPrivilege to dump the SAM. |
| Resolute | A password in a user's description and the DnsAdmins group to run code on the DC. |
| Monteverde | Password spraying with the username as password and the Azure AD Connect credentials. |
| StreamIO | SQL injection in MSSQL, Firefox credentials, ACL abuse and LAPS. The closest thing to an exam domain. |
A 10-week plan
| Weeks | What to do |
|---|---|
| 1-2 | 6 easy Linux boxes. Goal: the same method on all of them and a stable shell (reverse shell and TTY) |
| 3-4 | 6 Windows boxes. Goal: whoami /priv and winPEAS without thinking |
| 5-6 | The harder Linux boxes and the rest of Windows |
| 7-8 | The 7 Active Directory boxes, with BloodHound and NetExec |
| 9 | Redo, without notes, the ones you found hardest |
| 10 | Mock exam: 3 boxes you have not done + 1 domain, 24 hours straight, and a report |
Note
In the exam you can only use Metasploit on one machine. Get used to solving these without it: find the exploit with searchsploit, read it and run it by hand. The guide on how to exploit a public CVE explains how.
What next
If you prefer a guided path with these boxes, guides and cheat sheets in between and your progress saved, follow the Zero to OSCP path. To see how much it costs and how many job offers ask for it, check the OSCP page in the certification comparison.