u/ZerboaHaxor

I’m planning to take the exam in a month or two.

I’ve done the Proving Grounds machines from TJ Null’s list ( around 40-50 machines covers windows, linux, active directory )

I made a checklist for what to do when I find common services such as Web Services, SMB, LDAP, SNMP, SSH, FTP, and others where the case is without credentials, with only a username, and with valid credentials.

I also made pivoting notes covering things like opening target's local only ports with Chisel, making an internal subnet accessible with Ligolo-ng, and getting a reverse shell from an internal machine that isn’t directly accessible.

I made a checklist for Linux enumeration and privilege escalation, which, in my opinion, is relatively easy and straightforward.

I also made a checklist for Windows enumeration. I’m fairly confident with it, but not as confident as I am with Linux.

I also made a checklist for Active Directory

Tell me something that will humble me.

Is this a good sign ? or am I just overestimating how prepared I am?

1. Am i allowed to use hashescom hash decryption instead of hashcat/john in the exam ?
2. If im using custom pre-made enumeration tool, am i required to include the tool source code on the report ?

so i had solved TJ Null Windows and Linux PG Practice .

Should i extends Proving Ground and repeat the windows and linux blindly again.

Or subscribe to HTB and do tj null list ?

Im enrolling next month probably and this will be my final Subscription.

Ive Heard many time that cpts is "harder" however i also Heard alot that it basically the same just different methodology

For context i currently preparing for oscp (not buy it yet) by doing PG practice.

So far the pg labs is about enumeration, like fuzzing, brute forcing, finding credential, and CVE.

What about HTB lab that related to cpts ? Can anyone give example on what is the different ( not a solution tho just the difference)

I planned to take cpts as soon as i passed oscp

Edit: A friend of mine who passed oscp adviced me to not subs HTB pro labs before passing oscp because it Will ruin my PG methodology.

I wonder why?

So i made a script to do various enumeration using bash script.

• check_capabilities.sh
• check_cron.sh
• check_global_history.sh
• check_group.sh
• check_ports.sh
• check_procs.sh
• check_suid.sh
• check_writeable.sh
• suid_gtfobins.sh

Basicall all of this script is checking for possible LPE on linux.
Like capabilites, active cron, cron, writeable (just like linpeas, but without the noise it has).

There is no automated exploit except highlighting it.
Example cron_group will tell if there is a dangerous group in current user ( i made a hardcoded list for dangerous group inside the script like disk, sudo, docker, disk, etc).

its allowed right ? its saved me alot of times on solving Proving Ground and it will be helpfull for exam in my opinion.

there is alot of proving ground writeup on the web, especially medium.
since its a "paid" content is it even allowed ? why is there so many writeup available online ?

So have subscribed proving ground and today is the billing date.

And they hasnt charge me yet and i cant open proving ground lab now.

Is it okay to cancel and resubscribe right away?

So before buying OSCP bundle i decided to buy the Proving ground first. I got some basic experience on linux and windows and AD. thats why i bought the proving ground first before the course.

So im doing the TJNull list and here is the problem, i dont feel the strugle from the practice. the reason is i keep seeing the "about this lab" when trying to start the lab. this is giving too much information that i can already tell where to go and what to look.

Is there a way to hide the description so that i can do the lab "blind"