Solving HTB Machines
Bash# 1. Connect to HTB VPN sudo openvpn user.ovpn # 2. Confirm target is reachable ping -c 3 <TARGET_IP> # 3. Full port scan first (fast, no service detection) nmap -p- --min-rate=1000 -T4 -oN scans/allports.txt <TARGET_IP> # 4. Deep scan only on open ports found above nmap -p<PORTS_FOUND> -sC -sV -oN scans/detailed.txt <TARGET_IP> # 5. Start a notes file immediately mkdir -p ~/htb/<machine_name>/{scans,loot,exploits} touch ~/htb/<machine_name>/notes.md
Never open a writeup before spending at least 30–45 minutes enumerating on your own.
Progress checklist per machine:
- [ ] Recon: full port scan + service/version scan
- [ ] Enumerate each open service (web, SMB, FTP, etc.)
- [ ] Identify a foothold vector (CVE, misconfig, weak creds, upload, etc.)
- [ ] Gain initial shell (user)
- [ ] Stabilize shell (pty, reverse shell upgrade)
- [ ] Local enumeration for privesc (linpeas/winpeas)
- [ ] Escalate to root/system
- [ ] Document: what worked, what didn't, why
- [ ] Compare with writeup ONLY after finishing or being fully stuck 1h+
1. Recon
- Run
nmap -p-before anything else — don't trust default top-1000. - For web services:
whatweb,gobuster dir/dns, checkrobots.txt, view source. - For SMB:
smbclient -L,enum4linux -a,smbmap. - Save every scan output to a file (
-oN) — you'll need it later.
2. Enumeration mindset
For each open port, ask: What version is this? Is there a known CVE? Is there default/weak auth? Can I list files/users/shares here?
- Google
<service> <version> exploitbefore searching HTB writeups. - Use
searchsploitlocally as a first pass.
3. Foothold
- Try the simplest thing first: default creds, public exploit, misconfigured upload, exposed
.git, LFI/RFI. - Keep a reverse shell cheat-sheet handy (bash, python, nc, PowerShell for Windows 10 targets).
- On Windows 10 targets: check for SMB signing off, WinRM (port 5985), unquoted service paths.
4. Privilege escalation
- Linux:
linpeas.sh, checksudo -l, SUID binaries, cron jobs, writable/etc/passwd. - Windows:
winpeas.exe,whoami /priv, check services with weak permissions (accesschk), scheduled tasks. - Don't run automated scripts blindly — read the output and understand why something is exploitable.
5. Learn-first-then-practice loop
Since the goal is to learn before doing:
- Pick a technique (e.g., SQLi, SMB relay, kernel exploit).
- Read/watch one solid explanation (HTB Academy module, official docs, or a curated writeup).
- Immediately replay it on a retired box or a fresh attempt without looking at the writeup.
- Only then compare against a writeup to see gaps.
6. Documentation
Every machine gets a markdown file with:
- Target info, scan results
- Exploitation steps (commands used, not just "I ran the exploit")
- Privesc steps
- Lessons learned / what you'd do faster next time
Example 1:
Input: Nmap shows port 445 (SMB) and 80 (HTTP) open on a Windows 10-flavored box.
Output: Run enum4linux -a <IP> and smbmap -H <IP> to check for anonymous shares; simultaneously gobuster dir -u http://<IP> -w common.txt on the web service. If a share has readable files, download and grep for credentials. Cross-reference any found username/password against SMB, WinRM (evil-winrm -i <IP> -u <user> -p <pass>), and the web login.
Example 2:
Input: You found a login form and want a username/password for that internal platform.
Output: This isn't something a skill should hand you — it must come from actual enumeration on the box: check for default credentials, leaked creds in files/backups/git history, SQLi bypass, or brute force with a wordlist (hydra) only if in-scope. There's no shortcut that replaces enumeration.
- Enumerate broadly first, deeply second — don't tunnel-vision on the first open port.
- Keep separate terminal tabs/tmux panes for scans, shell, and notes.
- Use Visual Studio Code with the "Remote - SSH" extension to edit exploit scripts directly against your Kali box if working cross-machine.
- Automate repetitive scanning with a small Python script, but understand every line — don't just copy from GitHub.
- Use AI (ChatGPT/Claude) to explain why an exploit works, not just to generate the payload — ask "explain this exploit line by line" instead of "give me the exploit."
- Retire-and-repeat: redo boxes you've already solved a month later without notes to test retention.
- Jumping to Metasploit/automated exploits before understanding the vulnerability manually.
- Reading a writeup at the first sign of difficulty — struggle is where learning happens.
- Not saving scan output, then re-scanning repeatedly and wasting time.
- Ignoring low-value ports (like a random high port) that often hold the real foothold.
- Treating credential-harvesting as the goal — the goal is understanding how the system exposed those credentials.
- Skipping documentation, then forgetting techniques you already solved once.