HTB-machines - To BrushUp ALL

 

 HTB Red Team Skill Path – Machine Roadmap

📁 1. Web Application Exploitation

Level	Machine	Key Concepts
🟢 Beginner	Oopsie	IDOR, insecure admin panel
🟢 Beginner	Nibbles	Web enum, file upload abuse
🟡 Intermediate	Photobomb	Auth bypass, file read
🟡 Intermediate	Spectra	Git exposure, logic flaw
🔴 Advanced	Support	Helpdesk abuse, RCE chain
🔴 Advanced	Jewel	Ruby web app, custom logic

📁 2. Network Exploitation

Level	Machine	Key Concepts
🟢 Beginner	Netmon	FTP + SNMP
🟢 Beginner	Valentine	Heartbleed, memory leak
🟡 Intermediate	Postman	Redis RCE + SSH
🟡 Intermediate	Beep	Multiple services (SMTP, SNMP, HTTP)
🔴 Advanced	Cronos	DNS subdomain exploit
🔴 Advanced	ForwardSlash	Apache misconfig, reverse logic

📁 3. Linux Privilege Escalation

Level	Machine	Key Concepts
🟢 Beginner	Nibbles	Sudo misconfig
🟢 Beginner	Bashed	Script abuse (already done ✅)
🟡 Intermediate	Shoppy	Docker abuse
🟡 Intermediate	Irked	Exploit → DirtyCOW
🔴 Advanced	SolidState	Chained escalation (cron, sudoers)
🔴 Advanced	Nineveh	Multi-step + misconfig

📁 4. Windows Privilege Escalation

Level	Machine	Key Concepts
🟢 Beginner	Devel	Weak FTP perms
🟡 Intermediate	Optimum	WebDav + shell
🟡 Intermediate	Sauna	Token abuse, AD enum
🔴 Advanced	Forest	Realistic AD privilege chain
🔴 Advanced	Buff	Exploit + custom privilege escalation

📁 5. Active Directory Pentesting

Level	Machine	Key Concepts
🟢 Beginner	Responder	LLMNR poisoning
🟢 Beginner	PC	Null sessions, SMB enum
🟡 Intermediate	Cascade	Password reuse + ACL
🟡 Intermediate	Sauna	Kerberoasting
🔴 Advanced	Active	AS-REP Roasting
🔴 Advanced	Blackfield	DCSync, SID abuse
🔴 Advanced	Sizzle	Full AD attack chain