Step 270. One HTB Medium Machine (Cumulative 5) + Medium Graduation Review

Level 3 — Real-World CTF & Advanced Offensive Skills | Difficulty ★★★★☆ | Estimated time: 1–2 days

Prerequisites: you’ve rooted 4 HTB Medium machines (Step 265–269). You have the technique classification table (Step 105) and the asset-list habit (Step 269).

What you need: an HTB account with VPN connection, your personal wiki, and your 4 Medium attack records so far.
⚠️ All exercises in this chapter are for your own lab and legal platforms only. Applying them to unauthorized systems is a crime. Hack The Box (hackthebox.com) is a legal learning platform officially opened by its operators for attack practice — today’s techniques are used on HTB machines and nowhere else.
Screen note: every HTB connection screen and machine attack scene is a screen example. The actual connection and solving happen by your own hands.
Character note: today is half combat (the fifth Medium), half consolidation (the graduation document).

Five Medium machines are proof of "intermediate skill." But solved is not the same as organized — if five attacks lie scattered in your head, that’s five experiences, not skill. Today you solve the last one, review all five as a whole, and extract "the Medium patterns."

This consolidation is the cornerstone of the next stretch (Hard). The person who survives Hard is not the one with more techniques but the one who knows their own patterns and weaknesses exactly.

1. Learning Objectives

By the end of this chapter, you will be able to:

Independently attack a fifth Medium machine
Organize 5 machines’ attack records into a synthesis table (entrance, escalation, time spent, lessons)
Rank "the patterns that appeared most on Medium" by frequency analysis
Distinguish "machines solved by luck" from "machines solved by skill" to prevent overconfidence in self-assessment
Complete a one-page "Medium Attack Guide" for your future self and teammates

2. Background Knowledge — Today’s Tools and Concepts

Today’s Tools at a Glance

Category	Details
Language/environment	HTB platform (VPN) + personal wiki (Markdown)
Today’s commands	No new commands — full mobilization of the routine so far + tables for organizing
Concepts needed	Pattern extraction, frequency analysis, separating luck from skill, graduation criteria
Today’s deliverable	Cumulative 5 machines rooted + `Medium_Synthesis_Analysis.md` + `Medium_Attack_Guide.md`

2-1. Why Organize at the Fifth Machine

Three reasons. First, sample size — with two or three machines, coincidence gets mistaken for pattern, but with five, a repeating structure becomes visible. Second, freshness of memory — wait longer and the first machine’s stuck points blur. Third, timing — right before crossing into Hard is the best moment for "an inventory check of my arsenal."

Remember how in Step 105 you reassembled Bandit and Natas into "techniques." Today you do the same work at the level of real machines — that day’s technique cards are today’s synthesis table’s raw material.

2-2. The Synthesis Table’s Five Columns

Column	What to write	Why it’s needed
Machine	name, OS	so patterns can be split by OS
Entrance vector	the initial intrusion path (web vulnerability, credential reuse, etc.)	"where are Medium’s doors mostly?"
Escalation technique	the core technique of user → root	"what are Medium’s stairs mostly?"
Time spent	recon/intrusion/escalation separately	where time goes is the weakness map
Core lesson	one sentence	a sentence to reuse on the next machine

The "time spent" column is, surprisingly, the most important. Skill shortage reveals itself as time use — someone who burned 70% on enumeration has no enumeration system; someone who spent 3 hours on escalation needs to revisit the privesc checklist.

2-3. Separating Luck from Skill

Getting overconfident on the mere fact of having solved all five will hurt you badly on Hard. Give each machine an honest grade.

Solved by skill: every time I got stuck, my system (asset list, checklists) told me the next move
Got lucky: the first thing I tried happened to work, or I peeked at a write-up, or someone else’s hint was decisive

A machine solved by luck is not "unsolved" — but that machine’s pattern is not yet mine, so mark it separately in the synthesis table. The graduation criterion is not "5 cleared" but "of the 5, how many did I solve with my own system."

2-4. The Graduation Document’s Readers Are Future Me and Teammates

The Medium_Attack_Guide.md you make today is not a blog post but an operations manual. It has two readers — me three months from now, stuck on Hard and returning to Medium to review, and the colleagues following this book behind me. What these readers need is not fine prose but "what do I do in the first 30 minutes when handed a Medium machine" and "when stuck somewhere, where do I fall back to."

3. Follow Along

3-1. Attacking the Fifth Medium

Combat first. Pick the machine that will be cumulative number 5. This time, consciously apply the routine so far "like an experiment" — proceed while staying aware, start to finish, of Step 268’s enumeration depth and Step 269’s asset list and chain thinking.

During the attack, leave a time log (screen example):

[14:00] machine deployed, nmap started
[14:25] web enumeration — gobuster, vhost check
[15:10] entrance found — webshell via file-upload bypass
[15:40] user.txt secured
[17:30] privilege escalation — root via SUID binary (GTFOBins)

The time gaps in this log become the "time spent" column of the 3-2 synthesis table. Solve without records and you have no material to organize.

3-2. Writing the 5-Machine Synthesis Table

Once you’ve caught root (or the timebox ends), create Medium_Synthesis_Analysis.md in your wiki and lay all five machines in one table. Below is a format example — fill it with your actual records (the table contents are a screen example).

Machine	OS	Entrance vector	Escalation technique	Time spent	Core lesson
M-1	Linux	backup file in a web directory → credentials	abused sudo script	6h (enum 4)	enumerate wide first
M-2	Windows	default credentials → SMB access	AlwaysInstallElevated	4h	try default accounts first
M-3	Linux	upload bypass → webshell	SUID + GTFOBins	5h (escalation 3)	bookmark GTFOBins
M-4	Linux	info disclosure → login → LFI chain	kernel vulnerability	7h	chain thinking (Step 269)
M-5	Linux	vhost enumeration → new domain	writable cron	3h	never skip vhosts

How to read it: the moment the table is complete, half the analysis is already done — laying five rows side by side itself exposes the patterns.

As you fill it in, blanks may appear — like the "time spent" cells for a machine with no time log. Don’t force estimates into those cells; write "no record." Only when blanks are honestly marked does the next analysis (3-4) use that fact as material.

3-3. Frequency Analysis — Ranking the Patterns

Look at the table and answer three questions.

Question 1: Where were the entrances mostly? In the example above, web-related (backup file, upload, LFI, vhost) is 4 of 5. In your table too, web will probably dominate — it’s a widely known tendency that most entrances on Medium Linux machines are web.

Question 2: What were the escalations mostly? sudo misconfiguration, SUID, cron, kernel vulnerability, service misconfiguration. Count which type repeated. The repeated type is "the fundamentals of Medium escalation" — it must be fully ingrained in your body.

Question 3: Where was the time spent? Sum the five machines’ time logs and compute the ratios.

Recon/enumeration:  12 hours (48%)
Intrusion:           8 hours (32%)
Privilege escalation: 5 hours (20%)

These ratios are your weakness map. If the enumeration share exceeds 50%, it’s time to overhaul the enumeration system; if the escalation share is high, reviewing Step 259–260’s checklists comes first.

3-4. Updating the Weakness Map — Stages Still Slow, and Their Causes

Overlay the technique classification table you made in Step 105 with today’s synthesis table. There are three questions.

What is the stage that stole the most time? (frequency analysis’s question 3)
Is the cause of slowness at that stage skill shortage or procedure absence? — skill shortage is "didn’t know"; procedure absence is "knew but skipped." The prescriptions differ.
What is one concrete action that fills that weakness? — write it as an action, like "on a web machine, make a vhost scan mandatory in the first 30 minutes," not "get better at enumeration."

Write these three answers under the synthesis table as the "weakness map." This document is your starting point for the Hard challenge (Step 273~).

3-5. The One-Page Medium Attack Guide

The final deliverable. Create Medium_Attack_Guide.md in your wiki and fill the skeleton below — with sentences drawn from your table and your weaknesses.

# Medium Attack Guide (v1)

## First 30 minutes routine
- nmap -sV -sC → full-port scan in the background
- If web is visible: check tech stack → directory scan → vhost scan
- Keep the asset-list document open from the start

## Entrance priorities (by my 5-machine frequency)
1. Web — backup files, uploads, LFI/RFI, injection
2. Credentials — defaults, reuse, exposed files
3. (update with your own ranking)

## Escalation routine
- Linux: sudo -l → SUID → cron → writable files → kernel
- Windows: winPEAS → service permissions → registry → tokens

## When stuck
- 30 minutes stalled → asset list × untried surfaces multiplication (Step 269)
- Never repeat the same hypothesis → regress to enumeration
- Never repeat the same hypothesis → regress to enumeration

## My weaknesses and cautions
- (3-4's answers go here)

Why one page: at two pages, it stops getting read. A document unfolded mid-combat must fit on one screen. For details, link out from each item to your write-ups.

3-6. Self-Check Before Declaring Graduation

Guide complete? Then the last question — "of these five machines, how many did I solve by skill?"

4–5 machines: you may declare Medium graduation. Proceed to the Hard challenge at Step 273.
2–3 machines: graduate, but reinforce by solving one more machine of the type (entrance or escalation) you got lucky on.
0–1 machines: honesty is required. Solve 1–2 more Mediums without write-ups and redo this review. It’s not falling behind — it’s the fast road.

4. Missions & Exercises

Mission — The Medium Graduation Package

Attack one HTB Medium machine (cumulative 5) with a time log
Complete the 5-machine synthesis table and frequency analysis (entrance, escalation, time) in Medium_Synthesis_Analysis.md
Update the weakness map (slowest stage, cause, prescription action)
Complete the one-page Medium_Attack_Guide.md and link each item to your write-ups
Mark the skill/luck distinction and judge graduation for yourself

Exercises

Exercise 1. Explain, using the word "sample," why patterns are extracted at five machines rather than two or three.

Exercise 2. Explain the principle by which the "time spent" column reveals skill shortage.

Exercise 3. Explain why "machines solved by luck" must be marked separately in the table, connecting it to the graduation criterion.

Exercise 4. Explain with examples the difference in prescription between a weakness whose cause is "skill shortage" and one whose cause is "procedure absence."

5. Model Answers & Completion Criteria

Mission Model Answer

3-2’s table format is the skeleton. The five rows must be filled with actual records, and the answers to frequency analysis’s three questions (entrance, escalation, time) must exist as sentences. The guide must fit one screen, with each item written as an action.

How to verify: ① are all five columns of the synthesis table filled? ② Does the frequency analysis contain numbers (not "there was a lot of web" but "4 of 5")? ③ Is the weakness map’s prescription written as an action? ④ Does each guide item link to your write-up? ⑤ Is the skill/luck distinction marked?

Exercise Answers

Answer 1. With a small sample, coincidence gets mistaken for pattern. Two machines both entering through web could be chance, but four of five entering through web can be read as a tendency. Pattern extraction is the work of catching a repeating structure, so it needs a sample large enough for the structure to show (five machines).

Answer 2. Stages where you have skill pass quickly by procedure; stages where you don’t burn time in trial and error. So the ratio of time spent per stage becomes a map of skill level — if 48% went to enumeration, that stage’s system is the first place to fix.

Answer 3. Because the graduation criterion is not "number cleared" but "number solved with my own system." An entrance that happened to work or an escalation passed on someone else’s hint will not reproduce on the next machine. Without the distinction marked, only the number "5 cleared" remains and turns into overconfidence, and on Hard you pay the price of that overconfidence.

Answer 4. Skill shortage ("didn’t know") is filled by learning — e.g., if you didn’t know how to spot kernel vulnerabilities, study the concepts and solve practice machines. Procedure absence ("knew but skipped") is filled by checklist — e.g., if you knew vhost scans but skipped one, bolt it into the first-30-minutes routine as a mandatory item. Misdiagnosing the former as the latter wastes time re-studying what you already know.

Completion Criteria Checklist

[ ] I attacked the fifth Medium machine with a time log
[ ] I completed the 5-machine synthesis table (machine, entrance, escalation, time, lesson)
[ ] I ranked entrance, escalation, and time use by frequency analysis
[ ] I updated the weakness map (slow stage, cause, prescription action)
[ ] I distinguished machines solved by skill from machines solved by luck
[ ] I completed the one-page Medium Attack Guide and linked write-ups
[ ] I judged graduation for myself and decided the next action

6. Common Pitfalls & Fixes

Wall 1. Stuck into day two on the fifth machine

Symptom: you ran the whole routine and still can’t see the entrance.
Cause: on late Medium, "enumerate deeper" is often the answer — what wasn’t in the first scan is in the full port range, UDP, or vhosts.
Fix: regress to Step 268’s enumeration-depth checklist. nmap -p- full ports, UDP top 100, a large wordlist, vhosts/subdomains — one of these four hiding the entrance is a Medium constant.

Wall 2. Trying to fill the synthesis table, I can’t remember the first machine

Symptom: you don’t know what M-1’s entrance was.
Cause: you left no time log or asset list back then. A battle without records cannot be reviewed.
Fix: dig through that machine’s write-up (if you have one) or your HTB profile’s progress records and restore as much as you can. For cells that can’t be restored, write "no record" — that blank itself is today’s most valuable lesson ("records are skill").

Wall 3. Solved all five, yet no confidence that "I’m actually good"

Symptom: you cleared them, but you’re anxious.
Cause: a normal sensation, and actually a good signal — it means your metacognition is working.
Fix: quantify that anxiety’s identity with 3-6’s self-check. The sentence "4/5 machines solved by skill" turns anxiety into a plan.

Wall 4. The guide balloons to three, four pages

Symptom: organizing makes you want to include every technique.
Cause: you’re making the manual into an encyclopedia. A document unfolded mid-combat dies when it’s long.
Fix: keep the one-screen rule. What you cut is not deleted but linked — technique details already live in Step 105’s classification table and each write-up. The guide holds only the table of contents and the judgment criteria.

Wall 5. The frequency analysis turns into "my taste"

Symptom: you’re reading the fact "I like web, so I went deep on web" as the tendency "Medium has a lot of web."
Cause: your five-machine sample has your selection bias mixed in.
Fix: skim a few public community write-ups and cross-check the frequencies. If your table’s ranking differs from the community’s tendency, that difference is itself the list of "types I haven’t met yet."

Wall 6. Starting the write-up, I fret over "is this good enough to show people"

Symptom: while writing the guide, progress stalls as you polish sentences.
Cause: you’ve set the readership too wide. This document’s readers are future me and colleagues — people who already know the context.
Fix: exactly as Step 89’s principle, it only needs to pass searchability. However crude the sentences, "can I find and use this six months from now" is the sole criterion. Polishing it for public release is a later, separate job.

7. Summary

Today’s Concepts

Concept	One-line explanation
Pattern extraction	The work of laying individual attacks side by side in a table to find repeating structure; five machines is the minimum sample
Synthesis table	Five columns: machine, entrance, escalation, time spent, lesson; laying them side by side is itself analysis
Frequency analysis	Rankings of entrance, escalation, time use; the time ratios are the weakness map itself
Separating luck from skill	The graduation criterion is not clears but "solves with my own system"
Weakness map	Slowest stage + cause (skill/procedure) + prescription action; the starting point of Hard
One-page guide	An operations manual unfolded mid-combat; details go in links, the body holds only judgment criteria

Today’s Tools

Tool/document	What it does
Time log	Per-stage timestamps during the attack — material for the synthesis table’s "time spent" column
`Medium_Synthesis_Analysis.md`	5-machine table + frequency analysis + weakness map
`Medium_Attack_Guide.md`	One page holding the first-30-minutes routine, entrance priorities, escalation routine, stuck handling
Step 105 technique classification table	The previous arsenal to overlay with today’s review
Step 259–260 privesc checklists	Where to review when escalation is the weak stage

An Instinct More Important Than Commands

Organizing is not the cleanup after solving — it is the place where skill is born. Someone who solved five machines and just moved on had five experiences; someone who organized them into a table gained one pattern. Experience starts from zero in front of every new machine, but a pattern moves the starting point forward. And one more thing — today’s "separating luck from skill" habit is an attitude for all technical learning, beyond security. The growth curve of a person who doesn’t deceive themselves looks slow, then at some point climbs steeply.

Once every box is checked, Step 270 is complete. Click the checkbox in the sidebar to save your progress.