Skip to content

Commit 92885fd

Browse files
momenbaselmomenbasel
committed
Add writeup links to all cert-prep machines
- 54 machines now link directly to 0xdf writeups - Machine names are clickable links to the writeup - Added Writeup column to all tables (OSCP, CPTS, CRTO, CRTE, eWPT)
1 parent 2bd0497 commit 92885fd

1 file changed

Lines changed: 66 additions & 66 deletions

File tree

‎resources/cert-prep/README.md‎

Lines changed: 66 additions & 66 deletions
Original file line numberDiff line numberDiff line change
@@ -19,41 +19,41 @@ The gold standard for penetration testing. Focus on manual exploitation, no auto
1919

2020
**Recommended Easy Machines:**
2121

22-
| Machine | OS | Key Skills |
23-
|---------|-----|-----------|
24-
| Lame | Linux | Samba RCE (CVE-2007-2447) |
25-
| Legacy | Windows | MS08-067, MS17-010 |
26-
| Blue | Windows | EternalBlue (MS17-010) |
27-
| Devel | Windows | FTP + ASPX webshell, Kernel exploit |
28-
| Optimum | Windows | HFS RCE, MS16-098 |
29-
| Shocker | Linux | Shellshock (CVE-2014-6271) |
30-
| Nibbles | Linux | CMS file upload, sudo abuse |
31-
| Bashed | Linux | PHP webshell, cron abuse |
32-
| Valentine | Linux | Heartbleed, tmux session hijack |
33-
| Arctic | Windows | ColdFusion RCE, JuicyPotato |
34-
| Grandpa | Windows | IIS WebDAV, Token Impersonation |
35-
| Jerry | Windows | Tomcat default creds, WAR deploy |
36-
| Active | Windows | GPP cPassword, Kerberoasting |
37-
| Forest | Windows | AS-REP Roasting, DCSync |
38-
| Sauna | Windows | AS-REP Roasting, WinRM |
39-
| Buff | Windows | Gym Management RCE, CloudMe BOF |
40-
| Love | Windows | SSRF, AlwaysInstallElevated |
41-
| Cap | Linux | PCAP analysis, capability abuse |
42-
| Knife | Linux | PHP 8.1 backdoor, GTFOBins |
22+
| Machine | OS | Key Skills | Writeup |
23+
|---------|-----|-----------|----------|
24+
| [Lame](https://0xdf.gitlab.io/2020/04/07/htb-lame.html) | Linux | Samba RCE (CVE-2007-2447) | [0xdf](https://0xdf.gitlab.io/2020/04/07/htb-lame.html) |
25+
| [Legacy](https://0xdf.gitlab.io/2019/02/21/htb-legacy.html) | Windows | MS08-067, MS17-010 | [0xdf](https://0xdf.gitlab.io/2019/02/21/htb-legacy.html) |
26+
| [Blue](https://0xdf.gitlab.io/2021/05/11/htb-blue.html) | Windows | EternalBlue (MS17-010) | [0xdf](https://0xdf.gitlab.io/2021/05/11/htb-blue.html) |
27+
| [Devel](https://0xdf.gitlab.io/2019/03/05/htb-devel.html) | Windows | FTP + ASPX webshell, Kernel exploit | [0xdf](https://0xdf.gitlab.io/2019/03/05/htb-devel.html) |
28+
| [Optimum](https://0xdf.gitlab.io/2021/03/17/htb-optimum.html) | Windows | HFS RCE, MS16-098 | [0xdf](https://0xdf.gitlab.io/2021/03/17/htb-optimum.html) |
29+
| [Shocker](https://0xdf.gitlab.io/2021/05/25/htb-shocker.html) | Linux | Shellshock (CVE-2014-6271) | [0xdf](https://0xdf.gitlab.io/2021/05/25/htb-shocker.html) |
30+
| [Nibbles](https://0xdf.gitlab.io/2018/06/30/htb-nibbles.html) | Linux | CMS file upload, sudo abuse | [0xdf](https://0xdf.gitlab.io/2018/06/30/htb-nibbles.html) |
31+
| [Bashed](https://0xdf.gitlab.io/2018/04/29/htb-bashed.html) | Linux | PHP webshell, cron abuse | [0xdf](https://0xdf.gitlab.io/2018/04/29/htb-bashed.html) |
32+
| [Valentine](https://0xdf.gitlab.io/2018/07/28/htb-valentine.html) | Linux | Heartbleed, tmux session hijack | [0xdf](https://0xdf.gitlab.io/2018/07/28/htb-valentine.html) |
33+
| [Arctic](https://0xdf.gitlab.io/2020/05/19/htb-arctic.html) | Windows | ColdFusion RCE, JuicyPotato | [0xdf](https://0xdf.gitlab.io/2020/05/19/htb-arctic.html) |
34+
| [Grandpa](https://0xdf.gitlab.io/2020/05/28/htb-grandpa.html) | Windows | IIS WebDAV, Token Impersonation | [0xdf](https://0xdf.gitlab.io/2020/05/28/htb-grandpa.html) |
35+
| [Jerry](https://0xdf.gitlab.io/2018/11/17/htb-jerry.html) | Windows | Tomcat default creds, WAR deploy | [0xdf](https://0xdf.gitlab.io/2018/11/17/htb-jerry.html) |
36+
| [Active](https://0xdf.gitlab.io/2018/12/08/htb-active.html) | Windows | GPP cPassword, Kerberoasting | [0xdf](https://0xdf.gitlab.io/2018/12/08/htb-active.html) |
37+
| [Forest](https://0xdf.gitlab.io/2020/03/21/htb-forest.html) | Windows | AS-REP Roasting, DCSync | [0xdf](https://0xdf.gitlab.io/2020/03/21/htb-forest.html) |
38+
| [Sauna](https://0xdf.gitlab.io/2020/07/18/htb-sauna.html) | Windows | AS-REP Roasting, WinRM | [0xdf](https://0xdf.gitlab.io/2020/07/18/htb-sauna.html) |
39+
| [Buff](https://0xdf.gitlab.io/2020/11/21/htb-buff.html) | Windows | Gym Management RCE, CloudMe BOF | [0xdf](https://0xdf.gitlab.io/2020/11/21/htb-buff.html) |
40+
| [Love](https://0xdf.gitlab.io/2021/08/07/htb-love.html) | Windows | SSRF, AlwaysInstallElevated | [0xdf](https://0xdf.gitlab.io/2021/08/07/htb-love.html) |
41+
| [Cap](https://0xdf.gitlab.io/2021/10/02/htb-cap.html) | Linux | PCAP analysis, capability abuse | [0xdf](https://0xdf.gitlab.io/2021/10/02/htb-cap.html) |
42+
| [Knife](https://0xdf.gitlab.io/2021/08/28/htb-knife.html) | Linux | PHP 8.1 backdoor, GTFOBins | [0xdf](https://0xdf.gitlab.io/2021/08/28/htb-knife.html) |
4343

4444
**Recommended Medium Machines:**
4545

46-
| Machine | OS | Key Skills |
47-
|---------|-----|-----------|
48-
| Cronos | Linux | DNS zone transfer, SQLi, cron |
49-
| SolidState | Linux | Apache James RCE, cron privesc |
50-
| Poison | Linux | LFI, VNC tunneling |
51-
| Bastard | Windows | Drupal RCE, JuicyPotato |
52-
| Bounty | Windows | IIS upload bypass, JuicyPotato |
53-
| Jeeves | Windows | Jenkins Script Console, KeePass |
54-
| Conceal | Windows | IPSec VPN, SNMP, JuicyPotato |
55-
| DevOops | Linux | XXE, Git secrets |
56-
| Irked | Linux | UnrealIRCd backdoor, stego |
46+
| Machine | OS | Key Skills | Writeup |
47+
|---------|-----|-----------|----------|
48+
| [Cronos](https://0xdf.gitlab.io/2020/04/14/htb-cronos.html) | Linux | DNS zone transfer, SQLi, cron | [0xdf](https://0xdf.gitlab.io/2020/04/14/htb-cronos.html) |
49+
| [SolidState](https://0xdf.gitlab.io/2020/04/30/htb-solidstate.html) | Linux | Apache James RCE, cron privesc | [0xdf](https://0xdf.gitlab.io/2020/04/30/htb-solidstate.html) |
50+
| [Poison](https://0xdf.gitlab.io/2018/09/08/htb-poison.html) | Linux | LFI, VNC tunneling | [0xdf](https://0xdf.gitlab.io/2018/09/08/htb-poison.html) |
51+
| [Bastard](https://0xdf.gitlab.io/2019/03/12/htb-bastard.html) | Windows | Drupal RCE, JuicyPotato | [0xdf](https://0xdf.gitlab.io/2019/03/12/htb-bastard.html) |
52+
| [Bounty](https://0xdf.gitlab.io/2018/10/27/htb-bounty.html) | Windows | IIS upload bypass, JuicyPotato | [0xdf](https://0xdf.gitlab.io/2018/10/27/htb-bounty.html) |
53+
| [Jeeves](https://0xdf.gitlab.io/2022/04/14/htb-jeeves.html) | Windows | Jenkins Script Console, KeePass | [0xdf](https://0xdf.gitlab.io/2022/04/14/htb-jeeves.html) |
54+
| [Conceal](https://0xdf.gitlab.io/2019/05/18/htb-conceal.html) | Windows | IPSec VPN, SNMP, JuicyPotato | [0xdf](https://0xdf.gitlab.io/2019/05/18/htb-conceal.html) |
55+
| [DevOops](https://0xdf.gitlab.io/2018/10/13/htb-devoops.html) | Linux | XXE, Git secrets | [0xdf](https://0xdf.gitlab.io/2018/10/13/htb-devoops.html) |
56+
| [Irked](https://0xdf.gitlab.io/2019/04/27/htb-irked.html) | Linux | UnrealIRCd backdoor, stego | [0xdf](https://0xdf.gitlab.io/2019/04/27/htb-irked.html) |
5757

5858
---
5959

@@ -63,19 +63,19 @@ HTB's own penetration testing certification. Aligned with HTB Academy modules.
6363

6464
**Recommended Machines:**
6565

66-
| Machine | OS | Key Skills |
67-
|---------|-----|-----------|
68-
| Active | Windows | GPP abuse, Kerberoasting |
69-
| Forest | Windows | AS-REP Roasting, DCSync |
70-
| Cascade | Windows | LDAP enumeration, .NET reversing |
71-
| Monteverde | Windows | Azure AD, password spraying |
72-
| Resolute | Windows | DNS admin DLL injection |
73-
| Blackfield | Windows | AS-REP, backup operators privesc |
74-
| Intelligence | Windows | DNS records, GMSA, constrained delegation |
75-
| StreamIO | Windows | SQLi, MSSQL, LAPS |
76-
| Escape | Windows | MSSQL, ADCS ESC1 |
77-
| Vintage | Windows | Pure AD exploitation chain |
78-
| Certificate | Windows | ADCS certificate abuse |
66+
| Machine | OS | Key Skills | Writeup |
67+
|---------|-----|-----------|----------|
68+
| [Active](https://0xdf.gitlab.io/2018/12/08/htb-active.html) | Windows | GPP abuse, Kerberoasting | [0xdf](https://0xdf.gitlab.io/2018/12/08/htb-active.html) |
69+
| [Forest](https://0xdf.gitlab.io/2020/03/21/htb-forest.html) | Windows | AS-REP Roasting, DCSync | [0xdf](https://0xdf.gitlab.io/2020/03/21/htb-forest.html) |
70+
| [Cascade](https://0xdf.gitlab.io/2020/07/25/htb-cascade.html) | Windows | LDAP enumeration, .NET reversing | [0xdf](https://0xdf.gitlab.io/2020/07/25/htb-cascade.html) |
71+
| [Monteverde](https://0xdf.gitlab.io/2020/06/13/htb-monteverde.html) | Windows | Azure AD, password spraying | [0xdf](https://0xdf.gitlab.io/2020/06/13/htb-monteverde.html) |
72+
| [Resolute](https://0xdf.gitlab.io/2020/05/30/htb-resolute.html) | Windows | DNS admin DLL injection | [0xdf](https://0xdf.gitlab.io/2020/05/30/htb-resolute.html) |
73+
| [Blackfield](https://0xdf.gitlab.io/2020/10/03/htb-blackfield.html) | Windows | AS-REP, backup operators privesc | [0xdf](https://0xdf.gitlab.io/2020/10/03/htb-blackfield.html) |
74+
| [Intelligence](https://0xdf.gitlab.io/2021/11/27/htb-intelligence.html) | Windows | DNS records, GMSA, constrained delegation | [0xdf](https://0xdf.gitlab.io/2021/11/27/htb-intelligence.html) |
75+
| [StreamIO](https://0xdf.gitlab.io/2022/09/17/htb-streamio.html) | Windows | SQLi, MSSQL, LAPS | [0xdf](https://0xdf.gitlab.io/2022/09/17/htb-streamio.html) |
76+
| [Escape](https://0xdf.gitlab.io/2023/06/17/htb-escape.html) | Windows | MSSQL, ADCS ESC1 | [0xdf](https://0xdf.gitlab.io/2023/06/17/htb-escape.html) |
77+
| [Vintage](https://0xdf.gitlab.io/2025/04/26/htb-vintage.html) | Windows | Pure AD exploitation chain | [0xdf](https://0xdf.gitlab.io/2025/04/26/htb-vintage.html) |
78+
| [Certificate](https://0xdf.gitlab.io/2025/10/04/htb-certificate.html) | Windows | ADCS certificate abuse | [0xdf](https://0xdf.gitlab.io/2025/10/04/htb-certificate.html) |
7979

8080
**Recommended ProLabs:** Dante, Offshore
8181

@@ -87,13 +87,13 @@ Red team operations with Cobalt Strike methodology.
8787

8888
**Recommended Machines:**
8989

90-
| Machine | OS | Key Skills |
91-
|---------|-----|-----------|
92-
| Reel | Windows | Phishing, AppLocker bypass, AD |
93-
| Mantis | Windows | Kerberos MS14-068, AD |
94-
| Sizzle | Windows | ADCS, Kerberos, CLM bypass |
95-
| Multimaster | Windows | SQLi, DLL injection, AD |
96-
| APT | Windows | IPv6, RPC, domain recon |
90+
| Machine | OS | Key Skills | Writeup |
91+
|---------|-----|-----------|----------|
92+
| [Reel](https://0xdf.gitlab.io/2018/11/10/htb-reel.html) | Windows | Phishing, AppLocker bypass, AD | [0xdf](https://0xdf.gitlab.io/2018/11/10/htb-reel.html) |
93+
| [Mantis](https://0xdf.gitlab.io/2020/09/03/htb-mantis.html) | Windows | Kerberos MS14-068, AD | [0xdf](https://0xdf.gitlab.io/2020/09/03/htb-mantis.html) |
94+
| [Sizzle](https://0xdf.gitlab.io/2019/06/01/htb-sizzle.html) | Windows | ADCS, Kerberos, CLM bypass | [0xdf](https://0xdf.gitlab.io/2019/06/01/htb-sizzle.html) |
95+
| [Multimaster](https://0xdf.gitlab.io/2020/09/19/htb-multimaster.html) | Windows | SQLi, DLL injection, AD | [0xdf](https://0xdf.gitlab.io/2020/09/19/htb-multimaster.html) |
96+
| [APT](https://0xdf.gitlab.io/2021/04/10/htb-apt.html) | Windows | IPv6, RPC, domain recon | [0xdf](https://0xdf.gitlab.io/2021/04/10/htb-apt.html) |
9797

9898
**Recommended ProLabs:** RastaLabs, Zephyr
9999

@@ -105,13 +105,13 @@ Advanced Active Directory attacks and defenses.
105105

106106
**Recommended Machines:**
107107

108-
| Machine | OS | Key Skills |
109-
|---------|-----|-----------|
110-
| Blackfield | Windows | AS-REP, backup operators |
111-
| Multimaster | Windows | Complex AD chain |
112-
| Object | Windows | AD ACL abuse, GenericWrite |
113-
| Cerberus | Windows | ADCS, cross-domain trusts |
114-
| Rebound | Windows | Advanced Kerberos, RBCD |
108+
| Machine | OS | Key Skills | Writeup |
109+
|---------|-----|-----------|----------|
110+
| [Blackfield](https://0xdf.gitlab.io/2020/10/03/htb-blackfield.html) | Windows | AS-REP, backup operators | [0xdf](https://0xdf.gitlab.io/2020/10/03/htb-blackfield.html) |
111+
| [Multimaster](https://0xdf.gitlab.io/2020/09/19/htb-multimaster.html) | Windows | Complex AD chain | [0xdf](https://0xdf.gitlab.io/2020/09/19/htb-multimaster.html) |
112+
| [Object](https://0xdf.gitlab.io/2022/02/28/htb-object.html) | Windows | AD ACL abuse, GenericWrite | [0xdf](https://0xdf.gitlab.io/2022/02/28/htb-object.html) |
113+
| [Cerberus](https://0xdf.gitlab.io/2023/07/29/htb-cerberus.html) | Windows | ADCS, cross-domain trusts | [0xdf](https://0xdf.gitlab.io/2023/07/29/htb-cerberus.html) |
114+
| [Rebound](https://0xdf.gitlab.io/2024/03/30/htb-rebound.html) | Windows | Advanced Kerberos, RBCD | [0xdf](https://0xdf.gitlab.io/2024/03/30/htb-rebound.html) |
115115

116116
**Recommended ProLabs:** Cybernetics, APTLabs
117117

@@ -127,13 +127,13 @@ Focused on web application security.
127127

128128
**Recommended Machines:**
129129

130-
| Machine | OS | Key Skills |
131-
|---------|-----|-----------|
132-
| Talkative | Linux | Rocket.Chat exploit, Docker escape |
133-
| Forgot | Linux | Redis cache poisoning, password reset |
134-
| Bagel | Linux | .NET WebSocket, deserialization |
135-
| Sandworm | Linux | SSTI in GPG, Firejail escape |
136-
| Clicker | Linux | NFS, PHP SQLi, LFI chain |
130+
| Machine | OS | Key Skills | Writeup |
131+
|---------|-----|-----------|----------|
132+
| [Talkative](https://0xdf.gitlab.io/2022/08/27/htb-talkative.html) | Linux | Rocket.Chat exploit, Docker escape | [0xdf](https://0xdf.gitlab.io/2022/08/27/htb-talkative.html) |
133+
| [Forgot](https://0xdf.gitlab.io/2023/03/04/htb-forgot.html) | Linux | Redis cache poisoning, password reset | [0xdf](https://0xdf.gitlab.io/2023/03/04/htb-forgot.html) |
134+
| [Bagel](https://0xdf.gitlab.io/2023/06/03/htb-bagel.html) | Linux | .NET WebSocket, deserialization | [0xdf](https://0xdf.gitlab.io/2023/06/03/htb-bagel.html) |
135+
| [Sandworm](https://0xdf.gitlab.io/2023/11/18/htb-sandworm.html) | Linux | SSTI in GPG, Firejail escape | [0xdf](https://0xdf.gitlab.io/2023/11/18/htb-sandworm.html) |
136+
| [Clicker](https://0xdf.gitlab.io/2024/01/27/htb-clicker.html) | Linux | NFS, PHP SQLi, LFI chain | [0xdf](https://0xdf.gitlab.io/2024/01/27/htb-clicker.html) |
137137

138138
---
139139

0 commit comments

Comments
 (0)