Step 255. Hack The Box Starting Point Complete Run — Up to a Stage One Level Higher

Level 3 — Real-World CTF & Advanced Offensive Skills | Difficulty ★★★☆☆ | Estimated time: 5 hours

Prerequisites: Step 251~253 (the THM routine and Linux privesc), Step 254 (Windows intro). The concept of a reverse shell was learned in Level 2.

What you need: an internet connection, a Hack The Box account (free signup), an attack machine (Kali or WSL+tools), Step 251’s routine-recording document.
⚠️ All exercises in this chapter are for your own lab and legal platforms only. Applying them to unauthorized systems is a crime. Hack The Box (hackthebox.com) is a legal learning platform officially opened by its operators for attack practice — do not use today’s techniques on anything other than this platform’s machines.
Measurement note: the TTY upgrade commands in 3-3 were verified working on my WSL (Ubuntu 24.04) (2026-09-09), and the connection/attack screens on HTB machines are all screen examples.

If TryHackMe was "a practice ground with guidance," Hack The Box (HTB) is "the real thing with the guidance stripped away." Hints are scarce, machines are close to raw, and you poke at the same machine simultaneously with other players around the world. That’s why one HTB Easy machine matches the training volume of three or four THM Easy rooms.

Fortunately, HTB has prepared an approach trail too — Starting Point. It’s a bundle of tutorial machines that teach the rules of HTB-style machines, and today’s assignment is to complete it from start to finish. The rules you learn here — two flags, minimized hints, the shared-access environment — are the foundation of all three chapters ahead (Step 256~258).

1. Learning Objectives

By the end of this chapter, you will be able to:

Explain the structural differences between HTB and THM (hints, machine operation, flag style)
Connect to the HTB VPN and deploy Starting Point machines
Know the two-flag structure of user.txt / root.txt and how to submit them
Memorize the command sequence that upgrades an unstable shell to a full TTY
Observe the etiquette of a multi-user environment (unique filenames, quiet scans)

2. Background Knowledge — Today’s Tools and Concepts

Today’s Tools at a Glance

Category	Details
Language/environment	Hack The Box platform + attack machine (Kali/WSL) + HTB VPN
Today’s commands	`sudo openvpn file.ovpn`, `python3 -c 'import pty; pty.spawn("/bin/bash")'`, `export TERM=xterm`
Concepts needed	Starting Point, the two-flag structure, reverse shell stabilization, multi-user machines
Today’s deliverable	Starting Point completed + a note on HTB-style machine rules

2-1. THM vs HTB — What’s Different

Both are "real-machine platforms," but their design philosophies differ.

Item	TryHackMe	Hack The Box
Guidance	Tasks and questions show the way	No questions — only flags
Hints	Official hints inside the room	Forum hints (unofficial, spoiler warning)
Machines	Your own dedicated machine per room	Multiple users attack the same machine simultaneously
Flags	Question answers (various strings)	Fixed at two: `user.txt` and `root.txt`
Perceived difficulty	Easy is truly intro-level	Even Easy is at "the full set of standard techniques" level

The core difference is the presence or absence of questions. In THM, the questions were a checklist (Step 251). HTB has no such map — you must draw the path from recon to root yourself. That’s why your routine document substitutes for the map.

2-2. Starting Point — The Trailhead of HTB

Starting Point is HTB’s official intro machine series. The difficulty is labeled "Very Easy," but its role is tutorial — it teaches in sequence what HTB machines look like, where and how to submit flags, and how the VPN differs.

Unlike THM rooms, each machine comes with brief guidance and a designated "what you learn on this machine." One machine covers FTP anonymous access; another covers web shells and reverse shells. Progressing in order is designed to run you through one full cycle of the basic motions of HTB-style attacks.

2-3. Two Flags — user.txt and root.txt

The completion condition of an HTB machine is fixed.

user.txt  — evidence you got a regular-user shell (usually under /home/user/)
root.txt  — evidence you reached the highest privilege (usually under /root/)

The message this structure sends matters. Penetration (foothold) is only half. Even if you get a shell through a web vulnerability, that’s only as far as user.txt — root.txt demands privilege escalation. Correct here the THM Easy-room instinct that "shell = almost done" — on HTB, there’s always one more ridge between user and root.

2-4. Reverse Shell Stabilization — Why Arrow Keys Break

Reverse shells obtained through web vulnerabilities and the like are mostly non-TTY shells. You’ll recognize them by the symptoms — pressing an arrow key prints characters like ^[[A, pressing Ctrl+C kills the shell itself, and tab completion doesn’t work.

The cause is that the shell runs on a pipe without a pseudo-TTY. The fix sequence is fixed.

# 1. create a TTY with Python
python3 -c 'import pty; pty.spawn("/bin/bash")'
# 2. send it to the background
Ctrl+Z
# 3. switch your terminal to raw mode and return to the shell
stty raw -echo; fg
# 4. declare the terminal type
export TERM=xterm

These four lines are a sequence you’ll type several times a day on HTB. The goal isn’t memorizing them — it’s engraving them into your hands. You’ll actually verify them in 3-3.

2-5. Multi-User Machine Etiquette

THM room machines were yours alone, but HTB’s Starting Point and free machines are attacked simultaneously by multiple players. The phenomena this creates:

- A file you uploaded has vanished → someone else deleted it, or the machine reset
- Traces of an existing breach → shells/backdoors planted by other players
- Scans overlap and the service slows → one target, many attackers

The response rules are three. ① Make filenames unique — not /tmp/exploit.sh but /tmp/ex-mynickname.sh. ② Scan quietly — don’t crank speeds recklessly out of consideration for concurrent users. ③ Don’t touch others’ files — this stage isn’t a competition; it’s each person’s practice ground.

3. Follow Along

Sections 3-1~3-2 cover the HTB connection flow (screen examples), 3-3 is a hands-on measurement of the TTY upgrade on my WSL, and 3-4~3-5 show the Starting Point attack routine (screen examples).

3-1. Signup and VPN Connection

Create a free account at hackthebox.com.
Go to the Starting Point page and download the VPN config file — OpenVPN-based, same as THM.
Connect from your attack machine (screen example):

sudo openvpn starting_point.ovpn

...
Initialization Sequence Completed

Same procedure as THM, but the tunnel is different — you must connect with the HTB ovpn to see HTB’s 10.10.x.x ranges. If you poke at HTB machines with the THM tunnel up, you get no response. Don’t run both at once; to switch, cut the existing tunnel with Ctrl+C in its terminal and reconnect.

3-2. Deploying Your First Machine

Press "Spawn Machine" on the first Starting Point machine (screen example):

export TARGET=10.129.10.10   # HTB often uses the 10.129.x range
ping -c 3 $TARGET

64 bytes from 10.129.10.10: icmp_seq=1 ttl=63 time=52.1 ms

How to read the output: same as THM — if replies come back, the VPN and machine are alive. However, HTB machines can slow down temporarily from other players’ attacks, so if pings are intermittent, check again after a moment.

3-3. Measuring the TTY Upgrade — Verified on My WSL

These commands are used on reverse shells, but you can verify their behavior locally too. Here are the results I confirmed first on my measurement environment (WSL, Ubuntu 24.04.4, Python 3.12.3).

Input (measured — one line at a time into the shell):

printf 'tty\nexit\n' | python3 -c 'import pty; pty.spawn("/bin/bash")'

Output (measured, 2026-09-09):

root@XI3492:...# tty
/dev/pts/2
root@XI3492:...# exit

How to read the output: the tty command returned /dev/pts/2, a pseudo-terminal device. A shell running without a TTY prints not a tty for this command — this one line is the verification that "the upgrade took." After typing python3 -c 'import pty; pty.spawn("/bin/bash")' on a reverse shell, type tty: if /dev/pts/N comes back, success; if not a tty comes back, you’re still in a non-TTY state.

For reference, my measurement environment also had script (util-linux 2.39.3) and nc, but no socat. As an alternative for when the target machine has no Python, script -qc /bin/bash /dev/null does the same job — what matters is that there are several alternatives.

3-4. The Starting Point Attack Routine — One Note Page per Machine

Proceed through each machine like this (screen example):

nmap -sV -p- $TARGET

PORT   STATE SERVICE VERSION
21/tcp open  ftp     vsftpd 3.0.3

How to read the output: the early Starting Point machines have only one or two services open like this — a "this time, learn this service" design. If only ftp is open, investigation starts with an ftp anonymous login:

ftp $TARGET

Name (10.129.10.10:user): anonymous
230 Login successful.

How to read the output: if the anonymous login goes through, that’s the entrance. Practice finding this "one entrance" on each machine, and record it in your notes every time you find it.

# Starting Point notes
| Machine | Entrance (foothold) | What I learned |
|------|----------------|---------|
| (machine 1) | ftp anonymous login | anonymous FTP enumeration |
| (machine 2) | web default page → known default credentials | always try defaults |
| ... | ... | ... |

This table is the seed of Step 257’s "entrance-type table."

3-5. Through Flag Submission — The Definition of a Complete Run

The finishing sequence after getting a shell (screen example):

# from a regular-user shell
cat /home/user/user.txt

a1b2c3d4e5f6...   (screen example)

# after privilege escalation
cat /root/root.txt

f6e5d4c3b2a1...   (screen example)

Submit both flags in the input fields on the machine page, and the machine flips to "complete." Let’s be clear about the definition of a complete run — submitting both user and root on every Starting Point machine is today’s completion criterion. A machine where you only grabbed user is unfinished.

4. Missions & Exercises

Mission — Completing Starting Point and the Rules Note

Create an HTB account and connect with the Starting Point VPN
Attack the Starting Point machines in order from the beginning — submit both user.txt and root.txt on each machine
For each machine, record "what the entrance was" in the 3-4 table format
On at least one machine, after getting a reverse shell, perform the full TTY upgrade via 2-4’s four steps and verify with tty output
Apply a unique filename rule when uploading files (e.g., /tmp/tool-mynickname.ext)
After finishing, jot down "my strategy for approaching HTB Easy machines" in five lines or fewer — it becomes the next chapter’s operations document

Exercises

Exercise 1. THM room question lists served as checklists (Step 251). HTB doesn’t have them. What must fill that vacancy?

Exercise 2. Explain why arrow keys break in a reverse shell using the "pseudo-terminal" concept, and write what each of the four fix lines does.

Exercise 3. Explain why HTB machines place two flags, user.txt and root.txt — what the design of separating "penetration" from "completion" is trying to teach.

Exercise 4. Give at least two things that can happen if you use a common filename like /tmp/shell.sh on a multi-user machine.

5. Model Answers & Completion Criteria

Mission Model Answer

An example of the complete-run note’s shape (fill the contents with your actual solve):

# HTB Starting Point complete-run note (completed: ____)
- VPN: starting_point.ovpn, confirmed 10.129.x range
| Machine | Entrance | Escalation | What I learned | TTY upgrade |
|------|------|------|---------|----------------|
| #1 | ftp anonymous | not needed (root-level immediately) | anonymous FTP | - |
| #2 | web default credentials | sudo -l → GTFOBins | try defaults | O |
| ... | ... | ... | ... | ... |

# HTB Easy strategy memo (for Step 256)
1. Recon is one set: full scan + versions, plus path scan if web
2. No questions, so my routine document is the checklist
3. There's always one ridge between user and root — unfold Step 253's pattern notebook
4. If stuck for 6 hours, up to level-1 official forum hints only (spoiler-free ones)
5. Unique filenames, quiet scans

How to verify: ① Does your HTB profile show completion marks on all Starting Point machines? ② Can each machine’s entrance be explained in one line in your notes? ③ Is there a record of verifying the TTY upgrade with tty output? ④ Is the strategy memo written as "what to do next" (procedures, not sentiments)?

Exercise Answers

Answer 1. My routine document and enumeration results fill it. In THM, the author provided "the list of things to find" as questions; on HTB, the output of nmap -sV -p- itself becomes the list — the open ports and versions are exactly "the things to investigate on this machine." So the routine document you’ve built since Step 251 (the command order of recon → investigate → hypothesize → verify) substitutes for the map, and the regression point when stuck also changes from the question list to a self-check: "have I enumerated more?"

Answer 2. A reverse shell runs on a socket pipe, so it has no terminal device — there’s no agent (a pseudo-terminal) to interpret control characters like arrow keys, tab, or Ctrl+C, so they print as literal characters. The four fix steps: ① python3 -c 'import pty; pty.spawn("/bin/bash")' creates a pseudo-terminal with Python’s pty module and mounts bash on it. ② Ctrl+Z sends that shell to the background so you can manipulate your local terminal. ③ stty raw -echo; fg switches your terminal to raw mode (passing control characters through as-is) and returns to the shell. ④ export TERM=xterm declares the terminal type the shell uses for screen control, making arrow keys and screen clearing work.

Answer 3. That "getting in" and "taking over" are different skills. user.txt proves initial penetration (foothold) — the skill of opening the door via public vulnerabilities, misconfigurations, or weak credentials. root.txt demands privilege escalation — a separate skill of enumerating the system interior and finding misconfigurations or vulnerable setups. Splitting them in two lets the learner know precisely which side they’re stuck on — if you’re fast to user but always stuck at root, what needs reinforcing isn’t penetration but privesc.

Answer 4. ① If another player uploads a file with the same name, it gets overwritten — my shell gets replaced with someone else’s code. ② Another player may delete it while "cleaning up." ③ Even without a machine reset, collisions cause confusion — "I definitely uploaded it, but it’s gone" — and burn time. ④ Conversely, I might overwrite someone else’s file and break their solve. That’s why a unique name like /tmp/ex-mynickname.sh is basic etiquette on multi-user machines.

Completion Criteria Checklist

[ ] I created an HTB account and connected with the Starting Point VPN
[ ] I submitted user.txt and root.txt on every Starting Point machine
[ ] I wrote a per-machine entrance record table
[ ] I actually performed the four-step full TTY upgrade and verified with tty
[ ] I applied the unique filename rule
[ ] I can state at least five differences between THM and HTB
[ ] I wrote an HTB Easy strategy memo in five lines or fewer

6. Common Pitfalls & Fixes

Wall 1. Ping won’t reach the HTB machine — but the VPN is up

Symptom (example output):

--- 10.129.10.10 ping statistics ---
3 packets transmitted, 0 received, 100% packet loss

Cause: the most common case is poking at HTB machines while connected with the THM ovpn. The tunnel is open, but you’re connected to the wrong network.
Fix: check the name of the ovpn file you connected with — is it the Starting Point one? The address range in ip addr show tun0 is also a hint. Cut the tunnel (Ctrl+C), reconnect with the correct file, and if the machine is booting, wait 1~2 minutes and retry.

Wall 2. You pressed Ctrl+C in a reverse shell and the shell died

Symptom: you pressed Ctrl+C to interrupt a running command and the shell connection itself dropped.
Cause: in a non-TTY shell, Ctrl+C goes not to the command but to the entire shell process.
Fix: make the TTY upgrade (2-4’s four lines) the very first thing you do after penetration. If the shell died, keep the listener (nc -lvnp port) alive and re-trigger the exploit (re-invoke the vulnerable page, etc.) to reconnect. That’s why the habit is leaving your reverse-shell trigger in "a form you can fire again."

Wall 3. You typed python3 -c 'import pty; ...' but there’s no python3

Symptom (example output):

/bin/sh: 1: python3: not found

Cause: the target machine has no Python — common on minimal-install machines.
Fix: try the alternatives in order. ① python -c ... (Python 2), ② script -qc /bin/bash /dev/null (util-linux’s script — a standard tool present in my measurement environment too), ③ the socat family. Record which alternative worked in your notes, and you’ll pull it right out on the next machine.

Wall 4. A file you definitely uploaded has vanished

Symptom: a script you put in /tmp is gone a moment later.
Cause: it’s a multi-user machine — another player deleted it, the machine reset, or it’s operator-side cleanup.
Fix: avoid collisions first with the unique filename rule, and keep originals of important files on your attack machine to re-upload as needed. When a machine resets, all state except submitted flags is wiped — peace of mind comes from thinking of "everything on the machine is volatile."

Wall 5. It’s Starting Point, yet you’ve been stuck on the first machine for an hour

Symptom: you got as far as nmap but can’t think of what’s next.
Cause: Starting Point has guidance text for each machine — most likely you’re staring at the machine without reading it.
Fix: re-read the machine page’s description from the start. A sentence like "this machine’s topic is FTP" is a substantive hint. If you’re still stuck, drop the service name and version from your nmap results verbatim into a search engine. Searching at the Starting Point stage isn’t shameful — it is learning itself. Just remember that the rules change starting in Step 256.

7. Summary

Today’s Concepts

Concept	One-line explanation
Hack The Box	A real-world machine platform with hints minimized
Starting Point	HTB’s intro tutorial machine series
user.txt / root.txt	Penetration evidence / takeover evidence — HTB’s two flags
Foothold	Initial penetration — the first spot where you set foot in a system
Non-TTY shell	A shell without a pseudo-terminal — arrow keys, tab, Ctrl+C break
Pseudo-terminal (pty)	A device that connects programs as if it were a terminal
Multi-user machine	A shared target attacked simultaneously by multiple players

Today’s Commands & Tools

Command	What it does
`sudo openvpn file.ovpn`	Connect to the HTB VPN (a separate tunnel from THM)
`python3 -c 'import pty; pty.spawn("/bin/bash")'`	TTY upgrade step 1
`stty raw -echo; fg`	TTY upgrade step 3 (return)
`export TERM=xterm`	Terminal-type declaration — restores arrow keys
`script -qc /bin/bash /dev/null`	TTY alternative when there’s no Python
`tty`	Verify whether the current shell is on a TTY (`/dev/pts/N` = success)
`ftp $TARGET` → `anonymous`	Anonymous FTP login attempt

An Instinct More Important Than Commands

What completing Starting Point leaves behind isn’t a badge but three instincts. First, how to draw the path yourself in front of a machine with no questions — the instinct that nmap output is the problem set. Second, the instinct that getting a shell and making that shell "usable" are separate stages — the four TTY-upgrade lines must now live in your fingers. Third, the instinct that this stage is not your private practice ground — unique filenames and quiet scans are attitudes before they’re techniques. From the next chapter on come Easy machines with neither guidance nor tutorials. Today’s notes will be your map there.

Once every box is checked, Step 255 is complete. Click the checkbox in the sidebar to save your progress.