Step 256. HTB Easy ×2 — Alone to root: The First Complete Run Without Guidance

Level 3 — Real-World CTF & Advanced Offensive Skills | Difficulty ★★★★☆ | Estimated time: 8 hours+ (about 4 hours per machine)

Prerequisites: Step 255 (Starting Point complete run, HTB-style rules), Step 253 (privesc pattern notebook), Step 251’s routine document in hand.

What you need: Step 255’s HTB environment and complete-run notes, Step 253’s privesc pattern notebook, an editor for real-time notes, and sufficient time (one machine per day is recommended).
⚠️ All exercises in this chapter are for your own lab and legal platforms only. Applying them to unauthorized systems is a crime. Hack The Box (hackthebox.com) is a legal learning platform officially opened by its operators for attack practice — do not use today’s techniques on anything other than this platform’s machines.
Platform note: every HTB screen and command output in this chapter is a screen example. The actual attack is yours to carry out.

Today is the quietest and heaviest chapter of this curriculum. The task is simple — crack two HTB Easy machines from recon to root, with no write-ups and no hints, alone. Up through Starting Point, there was guidance. From today, there is none.

Let’s agree first on what "alone" means. Using a search engine to find technical documentation is not forbidden — official CVE descriptions, man pages, and tool documentation are resources used in real engagements too. Exactly one thing is forbidden: anything containing this machine’s solution — write-ups, walkthrough videos, blog posts with the machine’s name in them. Keeping that boundary is itself today’s training.

1. Learning Objectives

By the end of this chapter, you will be able to:

Explain the boundary between allowed and forbidden resources under "solving alone"
Know the difference between Active and Retired machines and select machines for training
Apply a routine (the 30-minute rule) that processes being stuck as procedure, not emotion
Record the attack process in real time to produce raw material for a write-up
Know the rules for using the minimal hint permitted after 6+ hours of being stuck

2. Background Knowledge — Today’s Tools and Concepts

Today’s Tools at a Glance

Category	Details
Language/environment	HTB Easy machines (Active recommended) + attack machine + routine document
Today’s commands	Everything learned so far — no new commands. From `nmap -sV -p-` to flag submission
Concepts needed	Active/Retired machines, stuck management (the 30-minute rule), real-time attack logs
Today’s deliverable	2 Easy machines solved independently (user+root) + 2 attack logs + an Easy-patterns summary

2-1. What HTB "Easy" Really Means

On HTB, "Easy" doesn’t mean "easy." It means "the required techniques are standard." No weird tricks or obfuscation — but the full cycle of standard techniques — recon, enumeration, penetration, privilege escalation — is demanded without omission.

If there were stretches in THM Easy that you passed with a hint’s help, those very stretches are on today’s exam. That’s why Step 251~252 set the rule "hint-used rooms go on the re-solve list." If those re-solves didn’t happen, today is effectively their re-exam.

2-2. Active vs Retired — Which Machine to Choose

HTB machines come in two states.

State	Description	Write-ups	Today’s choice
Active	Machines with points at stake in the current season	Official sharing forbidden — not floating around	Recommended
Retired	Retired machines	Official write-ups and videos everywhere	Requires self-restraint

On Retired machines, one search brings up the answer. In that environment, "solving alone" becomes a matter not of skill but of willpower. Active machines are structurally answer-free — the official rules forbid sharing solutions, so searching yields at most directional hints. For today’s independence training, Active is right. Note, however, that without a paid subscription your selection of Active machines may be narrow, and free slots are a multi-user environment (Step 255).

2-3. Stuck Management — The 30-Minute Rule

The real enemy of independent attacking isn’t difficulty — it’s the collapse of judgment while stuck. Realizing "it was wrong from the start" only after pouring three hours into one path — procedure is what prevents this.

[The 30-minute rule]
You've spent 30 minutes on one hypothesis (path) and not a single new fact has emerged
→ stop and move to one of these three:
  ① Regress to enumeration — any missed ports/paths/versions? (re-check the full scan)
  ② Re-order the hypothesis list — move to the next-priority candidate
  ③ Rest 15 minutes — trust the brain's background processing

The key is the presence or absence of "new facts." If logs grew and clues emerged over those 30 minutes, that path is alive. Continuing to knock when nothing came out — that’s the trap.

2-4. The Hierarchy of Hints — How Far Is Allowed

Prepare for when being stuck exceeds 6 hours by organizing allowed resources into tiers.

Allowed (anytime): tool documentation, man pages, CVE/technique explainer articles (ones without the machine's name)
Last resort (6h+): the official hint threads on the HTB forum — up to 1 "directional" comment only
Forbidden: write-ups, walkthrough videos, solutions on blogs/GitHub/Discord containing the machine's name

If you looked at a forum hint, record that fact in the log — "6h 20m, read 1 forum hint: web enumeration direction." Same rule as in Starting Point days. A stretch passed with a hint isn’t yours yet — it goes on the re-solve list.

2-5. The Real-Time Attack Log — Why You Solve While Writing

In independent attacking, records aren’t a byproduct — they’re a thinking tool. When stuck, reading "what have I done so far?" from the log separates the paths you’ve repeated from the paths you haven’t looked at. And this log later becomes your write-up manuscript — an asset you can share once the machine retires.

The format gets built in Section 3.

3. Follow Along

Today’s Section 3 is not "commands to run" but "procedures to follow." Every screen is an example; the actual attack is your share.

3-1. Machine Selection and the Opening Declaration

From the HTB machine list, pick a machine with difficulty Easy and state Active. Selection criteria:

- Something a few weeks old rather than brand-new (initial instability has settled)
- Linux OS first (so you can use Step 253's pattern notebook right away)
- Pick the two machines from different seasons (avoid repeating the same author's patterns)

Once you spawn the machine and get an IP, create the log file and declare the opening (screen example):

mkdir -p ~/htb/machinename && cd ~/htb/machinename
export TARGET=10.129.10.10
echo "# machinename — started $(date '+%F %T')" > log.md

One folder per machine, one log — this structure continues into Step 257~258.

3-2. Recon — The First Hour with the Log

Input (screen example):

nmap -sV -p- $TARGET -oN nmap-full.txt

Example output:

PORT     STATE SERVICE VERSION
22/tcp   open  ssh     OpenSSH 8.2p1 Ubuntu 4ubuntu0.5
80/tcp   open  http    nginx 1.18.0 (Ubuntu)

How to read the output: saving output to a file with -oN is what’s different from THM days — in independent attacking, every piece of evidence must remain as a file for the log to be reconstructable later. If web (80) shows, recon doesn’t end here:

# a path scan completes "one recon set" (screen example)
gobuster dir -u http://$TARGET -w /usr/share/wordlists/dirb/common.txt -o gobuster.txt

Set a completion condition for the recon stage — "full scan + versions + path scan (if web), plus writing 3 hypotheses into the log." Recon without hypotheses isn’t recon; it’s just a scan.

3-3. Hypothesis Priorities — The Log’s Core Page

When recon ends, write the hypothesis list into the log (example):

## Hypotheses (in priority order)
1. [ ] the web app behind nginx — found /admin path, try default credentials
2. [ ] ssh — collect valid usernames from the web, brute-force (last resort)
3. [ ] vulnerability in nginx 1.18.0 itself — check searchsploit (low likelihood)

## Attempt log
- 14:20 hypothesis 1 — /admin login form, admin:admin failed
- 14:35 hypothesis 1 — no SQLi signs on the login form
- 14:50 (30-minute rule triggered) — hypothesis 1 on hold, gobuster re-scan (bigger wordlist)

How to read the output: the timestamps in the "attempt log" are the referee of the 30-minute rule. As you write times and results, "I knocked on the same spot three times" becomes visible to you yourself. This log habit is the direct prerequisite of Step 258 (time-limited training).

3-4. From user to root — Unfolding the Pattern Notebook

Once you’ve reached user.txt, it’s time to pull out Step 253’s tools (screen example):

sudo -l
find / -perm -4000 2>/dev/null
cat /etc/crontab

How to read the output: the order is by frequency — sudo -l → SUID → cron. On HTB Easy machines, the answer usually shows on this first screen. If it doesn’t, then upload linPEAS to widen the candidates, and verify each one manually (Step 253’s principle — tools give candidates; humans verify).

When you read root.txt, summarize the path in one line in the log:

## Complete
- user: web app upload bypass → reverse shell (3h 10m)
- root: sudo -l → /usr/bin/sometool → GTFOBins (40m)
- hints used: none

3-5. The Rule for Machine Two — Pattern Summary

The second machine should ideally have a different entrance from the first. If the first was web, pick a service-centric machine (SMB/FTP/other) for the second. The reason: it’s the overture to "entrance-type diversification," which gets serious in Step 257.

When both machines are done, create the final deliverable — a summary of patterns that appear often at Easy:

## Easy patterns (observed across 2 machines)
- In the end, the entrance reveals itself to "the person who enumerated everything" — on both, the answer was something missed in the first scan
- Escalation was sudo -l 2 out of 2 — the value of the first command
- Web machines ultimately come down to a fight over path-scan wordlist size

Two machines make a small sample. That’s why this table keeps growing through Step 257 (cumulative 4) and Step 258 (cumulative 6).

4. Missions & Exercises

Mission — Solving 2 Easy Machines Independently

Select 2 Active Easy machines (no overlap in OS or entrance type)
Create a folder per machine and record the opening time in the log
Save all scan output to files with -oN/-o options
Progress while recording the hypothesis list and 30-minute-rule triggers in the log
Submit both user.txt and root.txt — on both machines
If you used a hint, record the time and content (how far you read) in the log and put it on the re-solve list
Write the "Easy patterns" summary from 3-5

Exercises

Exercise 1. Under the "solving alone" rules, CVE explainer articles are allowed while write-ups are forbidden. State the criterion separating the two in one sentence.

Exercise 2. In the 30-minute rule, the judgment criterion isn’t just "time" but "the presence or absence of new facts." Explain with an example why time alone isn’t enough.

Exercise 3. Explain the structural reason Retired machines are unsuitable for independence training, and give one situation where Retired machines are nevertheless useful.

Exercise 4. Explain what happens if you type only nmap in the recon stage and skip the web path scan, comparing it against "recon with a defined completion condition."

5. Model Answers & Completion Criteria

Mission Model Answer

An example of a machine log’s finished shape (contents are your actual solve):

# machineA — started 2026-09-10 14:00
## Recon
- nmap -sV -p- (nmap-full.txt): 22 ssh, 80 http nginx
- gobuster (gobuster.txt): found /admin, /uploads
## Hypotheses
1. [x] /uploads upload bypass → shell  ← this was the answer
2. [ ] ssh brute-force (on hold)
## Attempt log
- 14:40 found upload form, checking extension filter
- 15:30 (30-minute rule) filter bypass failing → re-scan with expanded wordlist
- 16:10 .phtml upload succeeded → reverse shell
## Complete
- user: 17:20 (3h 20m)
- root: sudo -l → GTFOBins, 17:55 (35m)
- hints used: none
## What I learned
- Upload filter bypass: tried case variation and double extensions but thought of .phtml late → add to checklist

How to verify: ① Does your HTB profile show user/root submissions for both machines? ② Are timestamps stacked in real-time order in the log (no signs of after-the-fact fabrication)? ③ Are scan output files in the same folder as the log? ④ Is hint usage written honestly? ⑤ Is the pattern summary observation (what repeated across the 2 machines), not "impressions"?

Exercise Answers

Answer 1. The criterion is "does it tell you this machine’s answer, or does it tell you a technique in general?" A description of CVE-XXXX and its exploit code concerns that vulnerability in general and is a resource consulted in real engagements too. A write-up, by contrast, is an answer key saying "on this machine, look here" — the moment you read it, this round stops being practice and becomes copying.

Answer 2. Because a living path keeps spitting out clues even past 30 minutes. For example, if while attacking a login form you discovered differences in error messages over 30 minutes and snagged one valid account, that path isn’t over time — it’s in progress. Conversely, if nothing changed in the output over 30 minutes, that’s data saying "nothing more will come out no matter how much you knock." The rule’s essence isn’t the timer but "judging a path’s life or death by its output."

Answer 3. Retired machines have official write-ups and walkthrough videos one search away, so "solving alone" comes to depend not on the information environment but on self-restraint — and the longer the stuck time grows, the more surely self-restraint collapses. Useful situations are verification and review: after solving a machine independently while Active, comparing the official write-up against your own solve once it retires to learn better paths; or deliberately using an answer-available environment when you want focused practice on a specific technique (e.g., attacking a particular CMS).

Answer 4. nmap tells you "which doors exist," but a web machine’s real entrance — an upload page, a backup file, an admin path — lies inside the door. Concluding "there’s only port 80 and no visible vulnerabilities" without a path scan is, in fact, "not looking inside." Recon with a completion condition (full scan + versions + paths + 3 hypotheses) blocks this gap procedurally — because trying to write 3 hypotheses usually forces the path scan along the way.

Completion Criteria Checklist

[ ] I selected 2 Active Easy machines (with non-overlapping types)
[ ] I left a log file and scan output files per machine
[ ] I submitted user+root on both machines without write-ups or walkthrough videos
[ ] I triggered the 30-minute rule and its record is in the log
[ ] I recorded any hint usage and put it on the re-solve list
[ ] The two machines’ entrance types differed
[ ] I wrote the "Easy patterns" summary

6. Common Pitfalls & Fixes

Wall 1. Three hours in with nothing to show — your mentality collapses first

Symptom: you’re repeatedly typing the same commands, and the log’s last timestamp is old.
Cause: the substance of being stuck isn’t technical — it’s a narrowing of vision. Trapped in one hypothesis, you can’t see answers already sitting in your enumeration results.
Fix: force-trigger the 30-minute rule — ① re-read the full-scan results from the beginning (ports you dismissed as "nothing much" the first time are frequently the answer), ② step away for 15 minutes, ③ read the log’s "attempt log" out loud. Three hours isn’t failure; it’s data — where the time went becomes material for Step 258.

Wall 2. You searched and accidentally saw a write-up

Symptom: you searched for a technique, but the results page showed a solution post for this machine, and you read the first paragraph.
Cause: even Active machines have unofficial solutions floating around. Perfectly avoiding them is near-impossible.
Fix: you can’t unsee it, so handle it honestly — record in the log "what content you saw up to where," and acknowledge that portion is no longer ‘independent solving.’ Finish the machine to the end, but put this machine on the re-solve list. Remember today’s training goal isn’t flags but "the experience of cracking through alone."

Wall 3. You got user but have been wandering at root for two hours

Symptom: sudo -l, SUID, and cron all yield nothing, and linPEAS just piles up red candidates.
Cause: either it’s a Windows machine and you’re only unfolding the Linux pattern notebook (or vice versa) — or your enumeration lacks depth.
Fix: regress via checklist — re-confirm the OS (uname -a or systeminfo), running processes (ps aux / Get-Process), abnormal files in home folders, /opt, /var, credentials inside config files. Verify linPEAS candidates one by one manually — ten red marks matter less than "one actually reproduced." If it still won’t break, the 6-hour rule (2-4) permits up to 1 directional forum hint.

Wall 4. Another player trashes the board on a multi-user machine

Symptom: the service dies and revives, your planted files vanish, port states change constantly.
Cause: free Active slots are shared environments (Step 255). Some players kill services with their exploits.
Fix: request a machine reset — HTB has a reset (reboot) button on the machine page. Note that a reset wipes all your traces on the machine too, so keep needed files locally. Targeting off-peak hours (late night to early morning in the target region) is also a real-world trick.

Wall 5. On machine two, you only repeat machine one’s techniques

Symptom: if machine one was an upload bypass, on machine two you only look for upload points.
Cause: successful paths carve deep into the brain — and that becomes the next round’s bias.
Fix: when writing the hypothesis list, consciously demote machine one’s techniques to lower priority. And if you honor 3-5’s rule — "machine two is a machine with a different entrance" — at the selection stage, this trap is avoided structurally. Bias correction is Step 257’s very subject.

7. Summary

Today’s Concepts

Concept	One-line explanation
Active / Retired	Current points machines (solution sharing forbidden) / retired machines (write-ups public)
Independent solving	Completing without resources containing the machine’s solution
The 30-minute rule	The procedure for switching hypotheses when 30 minutes pass with no new facts
The 6-hour rule	Beyond that, up to 1 directional forum hint is permitted
Real-time attack log	Timestamped attempt records — a thinking tool and write-up raw material
Hypothesis priorities	The completion condition of recon — a list of the next 3 things to knock on

Today’s Commands & Tools

Command	What it does
`nmap -sV -p- $TARGET -oN file`	Full scan + evidence file saved
`gobuster dir -u URL -w wordlist -o file`	Web path scan + saved
`sudo -l` / `find / -perm -4000` / `cat /etc/crontab`	The escalation first screen (in frequency order)
`mkdir ~/htb/machinename`	One folder per machine — the home of log and evidence
(procedure) 30-minute timer	The physical device of stuck management — a phone alarm works

An Instinct More Important Than Commands

Today’s completion condition isn’t four flags — it’s the confirmation that "in front of machines nobody tells me anything about, my routine rolled." Looking back, most stuck moments come not from technical shortage but from procedural deviation — skipping the full scan, knocking without hypotheses, clinging to a dead path. That’s why the 30-minute rule and the log aren’t decoration; they’re lifelines. And the sensation of the moment you open root.txt by your own strength — no lecture can give you that. Two machines is only the beginning. Stacking this experience to four, then six machines is the next two chapters.

Once every box is checked, Step 256 is complete. Click the checkbox in the sidebar to save your progress.