🧪 HTB Active Directory Labs (Auto-Pwn Benchmarks)

Why These HTB Labs Matter

If you practice AD labs regularly, you already know the hidden tax:

• DNS/NTP/tooling setup
• copy/paste between BloodHound, nxc, certipy, and notes
• re-typing creds and losing track of evidence

These labs are meant to remove that friction so you can focus on learning the attack chain.

Choose Your Path

🎓 Individual pentesters

If you want to learn AD attack chains faster, start with ADscan LITE and follow the walkthroughs.

👉 Install ADscan LITE or view the GitHub repo

💼 Security consultants (internal AD engagements)

If your consultancy runs 2+ internal AD engagements/year, you can request PRO beta access to validate the full reporting workflow on a real engagement:

• Time saved vs your baseline (target: ≥1 full day)
• Time to first usable credential (TTFC) and repeatability
• Client-ready PDF in 90 seconds from scan completion

👉 Request PRO beta access

Retired HTB Machines

These walkthroughs cover retired Hack The Box machines that can be automatically compromised using ADscan. All machines are officially retired and approved for public writeups.

Quick Reference

Getting Started with HTB

Prerequisites

1. Hack The Box account - Sign up at hackthebox.com
2. VIP subscription (optional) - For instant access to retired machines
3. VPN connection - Download and connect via HTB VPN
4. ADscan installed - See Installation Guide

Typical Workflow

# 1. Connect to HTB VPN
sudo openvpn lab_username.ovpn

# 2. Start ADscan
adscan start -v

# 3. Create workspace for the machine
workspace create htb_<machine_name>

# 4. Configure target
set iface tun0
set hosts <machine_ip>
set auto True

# 5. Launch attack
start_unauth

# 6. Wait for auto-pwn completion
# ADscan will automatically escalate to Domain Admin

Techniques by Machine

Initial Access

• Anonymous SMB - Active
• AS-REP Roasting - Forest
• Guest SMB + HR share spidering - Cicada

Credential Harvesting

• GPP Passwords - Active
• LDAP Attributes / Descriptions - Cicada
• Password Spraying Chains - Cicada

Privilege Escalation

• Kerberoasting - Active
• WriteDacl Abuse - Forest
• DCSync Attack - Forest

Learning Path

Beginner Path

1. Start with Active - Introduces GPP exploitation and Kerberoasting
2. Move to Forest - Learn AS-REP roasting and BloodHound analysis
3. Challenge yourself with Cicada - Multi-stage attack chain

Exam Preparation

These machines provide excellent practice for:

• OSCP - Active and Forest demonstrate common AD exam scenarios
• CRTP - All three cover core AD enumeration and exploitation
• PNPT - Real-world credential hunting and privilege escalation

Speed Running

Competition Times

Share your auto-pwn times in the ADscan Discord:

Current records (automatic mode):

• Active: TBD
• Forest: TBD
• Cicada: TBD

Optimization Tips

1. Pre-configure wordlists in ADscan settings
2. Use automatic mode for fastest times
3. Ensure proper network connectivity to minimize timeouts
4. Run BloodHound CE locally for faster analysis

Common Issues

VPN Connection

# Verify tun0 interface
ip addr show tun0

# Test connectivity to machine
ping <machine_ip>

# Check routing
ip route | grep tun0

IP Address Changes

HTB assigns dynamic IPs. Update ADscan target:

set hosts <new_ip>

Related Resources

• HTB Academy - Learn AD fundamentals
• ADscan Discord - Share times and get help
• HTB Forums - Machine discussions

Next Steps