The Book
How to think.
IF/THEN decision cards, prerequisites, and what each step proves — so you make the right call under pressure instead of running commands blind.
Companion to Active Directory Attack Paths · 5th Edition, Rev 5.1
The book teaches you how to think. Flightpath gets you to root.
A ready-to-run CherryTree operator companion to AD Attack Paths: the exact commands behind every decision card, the field tells that separate valid creds from a shell, and a live workspace to track a real engagement host by host.
96 nodesCherryTree .ctbSynced to Rev 5.1
Download Free .ctb Sample
Buy the Book + Flightpath Bundle — $160
Already own the book? Add Flightpath — $19
Free sample: five instructional nodes · CherryTree required · No email or payment needed.
$19 add-on · $160 bundle · Available now — private downloads after checkout
Why They Pair
Two halves of one workflow.
The book is the reasoning layer. Flightpath is the operator layer. Each points at the other, so you learn it once and run it forever.
Flightpath
How to do.
Every command ready to paste, cross-referenced to the book's cards, plus the field gotchas — clock skew, name resolution, tool bugs — that quietly eat your time.
What's Inside
96 nodes, organized the way you attack.
Enumeration → Active Directory → Privilege Escalation → Lateral Movement → Pivoting. Nothing to assemble — open it and work.
Full AD attack-path set — roasting, ACL abuse, delegation, AD CS (ESC1–8), DCSync, trusts, Golden/Silver tickets.
Windows & Linux privesc — matched depth, each vector gated by the privilege it needs.
Privilege → Attack reference — whoami /priv and /groups mapped to what each one unlocks.
Living engagement workspace — a template you clone per box, with notes and per-host tracking.
The gotchas, written down — the (Pwn3d!) tell, Kerberos prep, cmd-vs-PowerShell.
Book cross-references — nodes cite the exact cards behind the command.
Sample Node
The (Pwn3d!) tell.
One of the operator tells Flightpath spells out — how to read which boxes you already own before you ever open a shell.
# nxc marks admin access -- this is how you know which boxes you ALREADY own: [+] user:pass = creds VALID on that host (not admin) [+] user:pass (Pwn3d!) = creds are LOCAL ADMIN on that host ← your shell # Triage: spray ONE cred across the subnet, then read the (Pwn3d!) lines: $ nxc smb 10.0.2.0/24 -u user -p pass # psexec / wmiexec succeeding = you were already local admin. # Pwn3d! is strong evidence; the shell + whoami is the final proof.
Book cross-ref: decision cards 6N–6R, “WinRM Success,” p.36–38.
Pricing
Add it to the book, or get both together.
Already own the book
$19
Flightpath notebook add-on. The clean CherryTree .ctb template, synced to Rev 5.1.
Best value
$160
Book + Flightpath bundle. The 400-page 5th Edition Practitioner manual and the operator notebook together.
Responsible use: Buyers receive the clean template to populate — never anyone's engagement data. Commands and procedures are intended for intentionally vulnerable labs or systems covered by explicit written authorization. Purchase grants one customer a non-transferable license. Redistribution, resale, public posting, and removal of copyright notices are prohibited.
Template updates included with purchase
Return to your original secure purchase link to download the latest released Flightpath template at no additional charge. Release versions, dates, and change notes appear on the updates page.
Back up your working notebook. Open updates separately and copy new or revised nodes into your engagement notebook; replacing it could overwrite your notes and evidence.
Available now
The notebook arrives as a private ZIP containing the clean .ctb, single-user license, and instructions. CherryTree is required. Read the license and authorized-use terms. Contact us for team licensing.
View secure checkout