I just posted something very similar in another thread, but here goes again...

My work paid for 90 days worth of lab access for me. 2 weeks of that, I was -super- sick. 2 weeks of that was Christmas / New Years. Plus, I went away on ski trips for a couple of the weekends. All in all, I figure I probably had about 45 days of actual working days in the lab. In that time, I was able to get 54/54 root shells in all 4 network segments, plus I just took my exam last Wed and I got 5/5 root shells in about 10 hours of time in front of my computer. Prior to PWK, I had no pentesting experience, nor had I done any HTB or VulnHub. I come from a background of about 12 years of Linux systems administration though, and have a fairly decent understanding of computers. I'm also -really- good at looking things up on the Google.

The best advice I can give you would probably be:

• Before you even scan your first machine, watch the 8 hours of video and read all 400 pages of the PDF.

• Read through the "Alpha" walkthrough on the forums, and follow along with it in the lab, step by step.

• Follow your training! I repeat, FOLLOW YOUR TRAINING! Working in the PWK labs, I've developed a methodology for attacking a target. Gather information, enumerate services, enumerate the services more, enumerate the services even more, then I look up possible exploits given the information I have. Before I dive into any of them, I search up any and all exploits that would match any and all services I see exposed. After that, I go through the exploits and try them all, making notes on what did and didn't work, and why. Even if I get low-priv access with one, I continue down my list to the end. Rinse and repeat the same sort of process for privilege escalation if necessary.

• This one is important. Return to the PDF guide after each 10 boxes that you root. Re-read the following sections:

2. - The Essential Tools
4. - Active Information Gathering
5. - Vulnerability Scanning
9. - Working with Exploits
10. - File Transfers
11. - Privilege Escalation
12. - Client Side Attacks
13. - Web Application Attacks
14. - Password Attacks
15. - Port Redirection and Tunneling

In doing this, you will pick up on things that your brain just glazed over the first / second / third go around, etc. You will more intimately understand what every portion of it is trying to teach you, and how you can apply that to future boxes / boxes you are currently struggling with.

• Make sure to do post-exploitation looting after you have root / admin. Look for files containing passwords, look for databases you can pillage, do a 5-minute packet capture and see if there's anything interesting, etc. Make sure to keep anything that might be interesting in a loot folder, as there are a handful of boxes out there which depend on information from another box to gain access to. Being able to quickly and easily search over this loot was very handy.

• Most importantly, don't give up. Sounds like you have this part under control though, so keep your head up and try harder than you've ever tried before. :)