Best Hack The Box machines to learn Active Directory, in order
21 HTB machines to learn Active Directory from easy to insane, what each one teaches and the order to do them in to prepare for the OSCP, CPTS or CRTP.
You learn Active Directory by attacking domains, not by reading about them. The problem is that Hack The Box has hundreds of Windows machines and many of them mix ten techniques at once. This list is ordered so that each machine adds one or two new ideas on top of what you already know, from easy to insane, with what each one teaches according to the PwnAtlas catalog (which links every technique to the minute of the IppSec video where it is used).
Tip
Before you start, keep the Active Directory checklist at hand and use it on every box. If you want a full plan with guides and cheat sheets in between, follow the Red team and Active Directory path.
Level 1: the fundamentals (easy)
| Machine | What you learn |
|---|---|
| Forest | Enumerating users without credentials, AS-REP Roasting, BloodHound and an ACL chain to DCSync. The quintessential AD box. |
| Active | Passwords in GPP (Groups.xml) and your first Kerberoasting. |
| Sauna | Building usernames from the website, AS-REP Roasting and an account with DCSync rights. |
| Cicada | RID enumeration, password spraying and abusing SeBackupPrivilege to dump the SAM. |
| Timelapse | Cracking a ZIP and a PFX, logging in over WinRM with a certificate and reading the LAPS password. |
| Support | Pulling a password out of a .NET executable and abusing GenericAll over the DC with RBCD. |
With just these six you have the basic cycle: users, a first hash, BloodHound and an escalation to domain admin.
Level 2: modern AD (easy and medium)
| Machine | What you learn |
|---|---|
| EscapeTwo | From credentials in an Excel file to MSSQL, shadow credentials and ADCS ESC4 → ESC1. |
| Fluffy | Stealing an NTLMv2 hash with a .library-ms file, ACLs with bloodyAD and ADCS ESC16. |
| Administrator | Long ACL chains, targeted Kerberoasting and DCSync. You start with a user, as in an internal pentest. |
| Certified | WriteOwner, shadow credentials and ADCS ESC9. |
| Escape | Capturing the MSSQL hash with xp_dirtree, credentials in logs and a vulnerable certificate template (MSSQL attacks). |
| Intelligence | PDF metadata, a DNS record to capture a hash, gMSA and constrained delegation. |
| Cascade | LDAP with custom attributes, VNC passwords, decompiling .NET and the AD recycle bin. |
| Tombwatcher | Targeted Kerberoasting, reading gMSA, deleted objects and ADCS ESC15. |
Level 3: long chains (hard)
| Machine | What you learn |
|---|---|
| Blackfield | AS-REP Roasting, ForceChangePassword, an LSASS dump and SeBackupPrivilege to read NTDS.dit. |
| Search | Credentials in an image, Kerberoasting, a protected Excel sheet and gMSA → GenericAll. |
| Vintage | No NTLM: everything over Kerberos. Pre-Windows 2000 accounts, gMSA, DPAPI and RBCD. |
| Mirage | NFS on Windows, cross-session relay, gMSA and ADCS ESC10. |
Level 4: when nothing scares you any more (insane)
| Machine | What you learn |
|---|---|
| Rebound | Kerberoasting without credentials, cross-session relay, gMSA and RBCD all the way to DCSync. An AD masterclass. |
| Mist | Several hosts, relaying to LDAP, shadow credentials, ADCS and delegation. |
| Ghost | LDAP injection, a rogue DNS record to capture hashes, gMSA, ADFS and domain trusts. |
Getting the most out of them
- Go without help first, at least a couple of hours, following the checklist. When you get stuck, open the machine on PwnAtlas: each technique has a ▶ link to the exact minute of the IppSec video, so you see only the hint you need, not the whole solution.
- Write down the commands that work. In the end you will have your own cheat sheet; compare it with the Active Directory one.
- Redo the level 1 boxes without looking before moving on to level 3. Speed matters in the exam.
- Track your progress in My progress so you do not lose count.
The guides that go with this list, in order: Active Directory enumeration, Kerberoasting and AS-REP Roasting, ACL abuse, GPP, LAPS and gMSA, ADCS with Certipy, delegation and RBCD and NTLM relay.