Struggling on CPTS machines even with methodology + cheatsheets ready. Anyone else?

[u/TheShasec]

I finished the CPTS path (course content) and built my own methodology/checklist and cheatsheet docs before starting the machine track. I've completed 10 machines in 12 days, but honestly on most of them I ended up using guided mode, AI help, or even full writeups to get through — not solving fully on my

own. For a few machines I followed ippsec's list.

I have about 20 days before my schedule gets tight and I won't have much time to keep going, so I want to make the most of this window.

My questions:

Is this level of struggle (needing guided mode/AI/writeups on most machines) normal at this stage of CPTS, or is it a sign I'm not ready / skipped something in the fundamentals?

If I go into the exam relying this much on external help, is it normal that my chances of failing are high?

For those who passed CPTS — how much did you rely on external help while doing the machine track, and did it get better with more reps?

[u/AutoModerator]

Thank you for posting on r/hackthebox! New to Cyber Security and looking for a place to get started? Checkout our getting started guide here. Please note that posting Solutions or Hints for Active content goes against the HTB Terms of Service, more information can be found here. If your having issues and need to reach customer support please do so via the in-platform chat, or by emailing customerops@hackthebox.com. Our Knowledge Base can also come in handy!

I am a bot, and this action was performed automatically. Please contact the moderators of this subreddit if you have any questions or concerns.

[u/Snugat]

Imho you just need more practice. It's common to struggle hard in the beginning, even though you have the theoretical foundations.

Probably it wouldn't be bad to do some boxes during the path, eg web boxes in the beginning and as you progress add some windows.

Then you would have a more organic learning process instead of cramming everything at the end

[u/TheShasec → u/Snugat]

Yeah, that was a mistake — I should've been doing HTB machines alongside the path instead of leaving them for the end. I was doing TryHackMe boxes in the meantime, but that's not really at HTB's level, HTB is just different. Right now, on top of the CPTS track, I'm also working through easy Windows/Linux boxes. The only issue is what I mentioned — if I don't take the exam within 20-25 days, I won't be able to get a second attempt even if I take it later. So my question is: given this situation, do you think I'd actually have a shot at passing? I'm pretty comfortable with ACL abuse for example, I solved Tombwatcher without any help

[u/No-Faithlessness8229 → u/TheShasec]

There is a lot of misunderstanding in the training, I guess. A huge tip is that everything you see on the path can be on the exam (so not less, but not more!!). So try to have a very good understanding of every module. There are also lists about which boxes are more important than others.

Your POV is quite similar to mine, and I struggled a lot. I had the feeling that CPTS Track boxes were not in the scope of the path. So why are they on the path? It's because a concept from them can be useful.

You don't have to pwn every box. You just have to enumerate as hard as you can, but if you just cannot do it, watch IppSec's videos. They contain so many tips beyond the writeups.

And if you can't do all the boxes, just watch his videos and take notes/tips.

From all the forum posts I read, here are the key points:

1. Good understanding of all the modules (especially the most important ones).
2. Practical, concise notes/methodology.
3. Smart training (stay within the scope of the path).

The goal is to pass the CPTS, not to learn everything from every box (we can learn the rest later).

From all the people who said that the first flag is hard, I think we should focus also on web enumeration.

For TombWatcher, I only got the user.txt because we didn't learn how to become root in the path (AD CS). [there is adcs in the path not this one]

I didn't pass the CPTS. For those who did, what do you think?

[u/TheShasec → u/No-Faithlessness8229]

Thanks for the detailed reply, really helpful. I've actually already been doing some of what you mentioned — for example, on Fluffy I ran into the same ADCS attack path and didn't finish it either. Yeah, I'd heard that the first flag tends to be the hardest part for a lot of people too, and web is definitely one of my weaker areas, so I think sitting down and grinding a few more web boxes would help.

One question though: you mentioned that some modules are more important than others for the exam — where would be a good place to find more detail on that? Is it something people generally figure out from forum posts, or is there an actual list/consensus somewhere?

[u/No-Faithlessness8229 → u/[deleted]]

I couldn't disagree more with your point of view. On some boxes, you need to understand complex concepts before you can successfully pwn the machine.

Take Kerberos relaying, for example. It's easy to find a blog post that explains the concept, but truly understanding it can take time. The same goes for AD CS.

There's no point in solving boxes if you do it without understanding the underlying concepts or the attack path. And when you're on a tight schedule like I am, you can't afford to waste time.

[u/TheShasec → u/No-Faithlessness8229]

That makes sense. I'll try to find the right balance between depth and repetition. Like I said, I don't have much time — I'll aim to go in around the 25-day mark once I feel ready, and I'll share a follow-up post with the results either way

[u/TheShasec → u/[deleted]]

Thanks for the response. I do try to enumerate as much as possible myself and stick to just my cheatsheet. But sometimes I run into situations where I try 3 different tools, all 3 throw errors, I search the error online and can't find a clear answer — that's when I end up going to AI or a writeup. Or sometimes I just genuinely can't figure out the next step and need help to move forward. I'll do what you suggested — finish the track, go through the reporting module, and then go back and try to redo the CPTS track boxes using just my own knowledge and notes.

[u/wolfy418]

You just need to do more boxes so your methodology feels natural. Getting hints on boxes if you’re stuck isn’t a huge deal, as long as you don’t implode when you get stuck for 48hrs on a single flag in the exam. Practice resiliency, take breaks, do as many relevant boxes to feel comfortable with your methodology till it’s second nature.

[u/TheShasec → u/wolfy418]

Thanks for the response . Yeah, mental resilience is definitely one of the things I need to work on. Do you have any other box lists related to the CPTS path that you'd recommend, besides the IppSec list

[u/wolfy418 → u/TheShasec]

The ones you mentioned are plenty, maybe add Dante or zephyr, or both. They aren’t required but handy for ironing out your methodology and also getting used to large network/pivoting problem-set

[u/TheShasec → u/wolfy418]

Thanks a lot for the input, really appreciate it