Step 278. ★ Real-World Check: Medium Time Attack + Presentation Practice — Solving and Explaining Are Different Muscles

Level 3 — Real-World CTF & Advanced Offensive Skills | Difficulty ★★★★★ | Estimated time: 2 days (8-hour time attack + 1 day of slides and rehearsal)

Prerequisites: Steps 276–277 speed training (4-hour and 8-hour time attacks) complete, Step 275’s debrief methodology.

What you need: one never-before-seen HTB or THM Medium machine, a timer, a screenshot tool, a slide tool (Markdown slides are enough), and recording capability (a phone camera is enough). The machine assault scenes in this chapter are screen examples.
⚠️ All exercises in this chapter are for your own lab and legal platforms only. Applying them to unauthorized systems is a crime. Hack The Box (hackthebox.com) and TryHackMe are legal learning platforms officially opened by their operators for attack practice — do not use today’s techniques on anything except these platforms’ machines. When publishing to a blog, always confirm the machine is retired.
This chapter is a test — the graduation exam of the live-machine section. No new techniques; it examines two muscles together: solving power and explaining power.

Solving and explaining are different muscles. If you can’t explain a machine you broke solo in 15 minutes when someone asks "so how did you break it?", that knowledge isn’t fully yours yet. Situation sharing in competition team play, write-ups, and someday a career interview — all of them demand "the ability to convey my solution to others."

Today’s verification structure is simple. Perform one last Medium time attack within 8 hours, structure that solution into a 15-minute presentation, record yourself, and grade it. "You know it only if you can explain it to someone else" — that sentence is today’s passing line.

1. Learning Objectives

By the end of this chapter, you will be able to:

Assault a Medium machine in an 8-hour time attack while simultaneously collecting presentation evidence (captures of decisive moments)
Restructure the solution into an 8-slide presentation: machine overview → recon → foothold chain → privesc → lessons
Write a presentation script around the 3 things the audience takes away, and cut the bloat
Grade your own recording with your own rubric to confirm explaining-power weaknesses in numbers
Carry out the procedure of turning a retired machine’s solution into a blog write-up

2. Background Knowledge — Today’s Tools and Concepts

Today’s Tools at a Glance

Category	Details
Language/environment	HTB/THM Medium machine, Markdown (slides, script, write-up), recording tool
Today’s commands	All review — the entire time-attack skill set of Steps 276–277
Concepts needed	Presentation structure (8 slides), the audience’s 3 things, the self-grading rubric, explainability = verification of understanding
Today’s deliverable	Time-attack log + 15-minute presentation materials (~8 slides) + rehearsal recording + self-grading results

2-1. Why a Presentation — If You Can’t Explain It, You Don’t Know It

This is the principle known as the Feynman technique — if you can’t explain it simply, you haven’t understood it properly. During an assault there are spots where "it worked, so I moved on." The command worked but you can’t explain why — write the presentation script and every one of those spots is exposed.

That’s why presentation prep is delivery training and at the same time the harshest debrief. If Step 275’s debrief was "the training of reading someone else’s thinking," today is "the training of making my thinking readable by others." Only together do they complete the skill cycle.

2-2. The 8-Slide Structure — The Audience’s Time Is 15 Minutes

There’s no time to tell the whole solution. The skeleton of a 15-minute talk is eight slides.

Slide	Content	Time
1	Machine overview — name, difficulty, one-line summary	1 min
2	Recon — what was visible, and what was suspicious	2 min
3	First judgment — which path you chose and the grounds	2 min
4	Stalls and pivots — fake entrances, discarded hypotheses	2 min
5	The foothold chain — the connecting links to the shell	3 min
6	Privilege escalation — from clue to root	3 min
7	Lessons — the 3 things the audience takes away	1.5 min
8	Close — reproduction cautions, Q&A	0.5 min

The key design point is that slide 4 (stalls and pivots) exists. A talk that tells only the success path reproduces the write-up trap (Step 275) as-is. What the audience really learns is "why that path was discarded."

2-3. The Audience’s 3 Things — The Criterion for Cutting

As the source material points out — when a talk gets bloated, keep only "the 3 things the audience learns" and cut the rest. Example 3 things:

The 3 things the audience takes from this talk:
1. A subtle difference in signup responses becomes an account-enumeration entrance
2. Mark blocked paths and discard them — the 2 discarded made the 1 that survived
3. The privesc clue is already visible during the foothold stage (the value of revisiting)

These three sentences are the script’s grading criterion — if a slide’s content supports none of the three, cut it. A talk with no cutting criterion tries to say everything and leaves nothing behind.

2-4. The Self-Grading Rubric — Watching the Recording Is the Second Exam

Record the rehearsal and grade it with the audience’s eyes. Five items, 2 points each.

Item	0 points	1 point	2 points
Time control	Over 18 min or under 12 min	±1 min over	15 min ±30 sec
Structure	8-slide order collapsed	1–2 slides missing	8 slides complete
Explainability	"It just works" 2+ times	Once	Every command has a reason
Evidence	Words only, no captures	Some decisive moments missing	All discovery/breakthrough scenes captured
Audience care	Jargon used freely without explanation	Only key terms explained	The audience’s 3 things are explicit

8 points or more is the passing line. Items below par become the improvement assignments for the next talk — only with this rubric does "explaining power" become measurable training, like the time attack.

3. Follow Along

3-1. Day 1 Morning — The Time Attack, Plus the Capture Habit

Perform Step 277’s 8-hour time attack as-is, with one added rule — save the screen at every decisive moment. Fix the list of decisive moments before starting.

Capture list (check before starting):
[ ] Recon results summary (the moment the attack surface stood up)
[ ] Entrance discovery moment (the suspicious response/file/field)
[ ] First shell (whoami included)
[ ] Privesc clue (the setting/file that decided the match)
[ ] Root proof (id included)
[ ] One stall scene (a discarded path — material for slide 4)

Why: the last item is today’s new rule. Failure scenes are things you don’t feel like capturing at the time, but they’re the only evidence for slide 4. Capturing only winning scenes was the habit up through the last match — from today, losing scenes are also stored as assets.

3-2. Day 1 Evening — Extracting the Talk Skeleton from the Log

When the time attack ends, extract the skeleton the same day. Memory is still alive. Lay out the lap-time log and captures in time order, and fill each box of the 8-slide structure with one sentence each.

Screen example (skeleton memo):

Slide 1: "This machine's answer wasn't the web — it was the signup form's response differences"
Slide 2: nmap 3 ports + gobuster results capture. Suspicious: /api docs exposed
Slide 3: chose the signup form among 3 candidates — grounds: response messages were leaking account existence
Slide 4: discarded — ① SSH brute-force (30-minute rule), ② SQLi (filtering)
Slide 5: account enumeration → default credential reuse → web shell → stabilization
Slide 6: cron on a backup script in /opt + write permission → root
Slide 7: the audience's 3 things (see 2-3)

How to read it: the boxes where a sentence won’t come are exactly "the stretches where understanding is shallow" — where 2-1’s warning becomes real. Re-read the log, and if needed, power the machine back on and reproduce just that stretch to pin down the reason. Making the presentation materials turns into a debrief right here.

3-3. Day 2 — Writing the Script and Cutting

Expand the skeleton into a script. Two rules.

Attach a reason to every command — not "I ran gobuster" but "a web service was visible, so I checked for hidden paths first." A command without a reason is noise to the audience.
After drafting, cut 20% — the criterion is 2-3’s "audience’s 3 things." A paragraph that supports none of the three gets cut, however precious.

17 min before cutting → 14 min 30 sec after (screen example)
Cut: the CVE-searching process for the SSH version (unrelated to the 3 things)
Kept: the rationale for discarding SQLi (directly tied to thing #2)

3-4. Rehearsal Recording and Self-Grading

Record the entire 15-minute talk in a quiet place — no stopping and redoing partway. The real thing has no rewind. Then watch the video and fill the 2-4 rubric.

Screen example (self-grading results):

| Item | Score | Memo |
|------|------|------|
| Time control | 1 | 16 min 10 sec — got long-winded on slide 6 |
| Structure | 2 | 8 slides complete |
| Explainability | 1 | "because this script is vulnerable" — couldn't explain why it's vulnerable |
| Evidence | 2 | All 6 captures used |
| Audience care | 1 | "cron job" used without explanation |
| Total | 7/10 | Fail — compress slide 6 + reinforce privesc-principle explanation, then re-record |

How to read it: a failing grade is this verification structure working normally. The memo "explainability 1 point" means — there was a stretch you could get past while solving but can’t put into words; that is, a hole in understanding has been discovered, with coordinates. Reinforce and re-record past 8 points, and only then do you "know" this machine.

3-5. Closing with a Write-up — Speech into Text

Once the talk passes, write the write-up from the same material. The structure is the 8 slides moved straight into text — except you restore in full the commands and output the talk omitted. If the presentation is a format that respects "the audience’s 15 minutes," the write-up is a format that respects "the reader’s reproduction."

One check before publishing — is the machine retired? Publishing a solution for an active machine violates platform rules and ruins other learners’ matches. If it isn’t retired, keep the draft and publish after retirement.

4. Missions & Exercises

Mission — Complete the Time Attack + 15-Minute Presentation

Assault a never-before-seen Medium machine in an 8-hour time attack — use Step 277’s budget table, self-reports, and saves as-is.
Fix the capture list (3-1) before starting, and save the 6 kinds of decisive moments — including one stall scene.
Extract the 8-slide skeleton the same day; for boxes where a sentence won’t come, pin down the reason and fill them.
Fix "the audience’s 3 things" first, write the script, then cut 20%.
Record the 15-minute rehearsal in one take and grade it with the self-grading rubric — below 8 points, reinforce and re-record.
(Optional) If the machine is retired, publish the write-up on your blog.

Exercises

Exercise 1. Why is presentation prep called "the harshest debrief"? How is it different from a debrief that only reads logs?

Exercise 2. Explain, from the audience’s learning standpoint, why "stalls and pivots" (slide 4) must be included in the talk structure.

Exercise 3. Why must "the 3 things the audience takes away" be fixed before writing the script?

Exercise 4. Why does the self-grading rubric have "explainability" as a separate item? What’s the prescription when this item scores low?

5. Model Answers & Completion Criteria

Mission Model Answer

Check against the verification criteria.

Time-attack diligence: are the budget table, self-reports, and saves in place to Step 277’s standard? Letting assault records go shallow in the name of presentation prep is putting the cart before the horse.
6 kinds of captures: in particular, is the "stall scene" there? An evidence folder with only success scenes means slide 4 can’t stand.
Skeleton completeness: does each of the 8 boxes have one sentence, and is there a trace (a reproduction record, etc.) of "reasons pinned down"?
Evidence of cutting: is there content deleted from the draft, and can you explain that the deletion criterion was "the audience’s 3 things"?
Grading repetition: is there a record of re-recording until reaching 8+ points — whether passed on the first take or the third, totals and memos remaining is enough.

Exercise Answers

Answer 1. Because a log debrief verifies "what was done," but writing a talk script demands "why it was done, in sentences others can understand." Mid-assault there can be commands you "moved on from because they worked," but in a script each command must carry a reason — when no reason comes out, the shallowness of understanding is exposed, with coordinates. Explanation discovers the understanding holes that records can’t.

Answer 2. Because what the audience really learns is not the success path but the discard rationale of the abandoned paths. A talk that tells only successes creates the same trap as a refined write-up (Step 275), giving the audience the illusion "the presenter knew from the start." Only with a stalls-and-pivots slide does the audience take home "I can get stuck too, and here’s how to judge when I do" — that is the talk’s learning value.

Answer 3. Because cutting needs a criterion. The whole solution can’t fit in 15 minutes, so something must be cut — and without a criterion you cut "in order of least precious," sacrificing the core first. With the 3 things fixed in advance, the judgment is mechanical: supports one of the three, keep; otherwise, cut. The criterion exists not for choosing content but for the fairness of deletion.

Answer 4. Because only by grading "can solve" and "can explain" separately do understanding holes become visible. The case where time and structure are fine but this item alone is low — that presenter has learned the procedure but is shallow on the principles. The prescription is not presentation technique but re-learning the relevant stretch — confirm with docs and reproduction why that command works, fix the script, and re-record. Read the score not as an injustice but as learning coordinates.

Completion Criteria Checklist

[ ] I performed the Medium time attack to Step 277’s standard (budget table, self-reports, saves)
[ ] I saved the 6 kinds of decisive-moment captures (stall scene included)
[ ] I completed the 8-slide skeleton with one sentence per box
[ ] I fixed "the audience’s 3 things" and cut 20% from the script
[ ] I completed a script with a reason attached to every command
[ ] I recorded the rehearsal in one take and filled the self-grading rubric
[ ] I reached 8+ points (re-recording record included)
[ ] (Optional) I wrote up the retired machine as a write-up

6. Common Pitfalls & Fixes

Wall 1. I forgot to capture and have no material for slide 4 (stalls)

Symptom: only success-scene captures exist; no screens of discarded paths.

Cause: mid-immersion there’s no mental room to capture failure scenes — normal.

Fix: merge the capture list into the self-report template — when filling the three boxes every hour, check together "was there a decisive moment in the last hour?" Devices substitute for habits. If you missed it anyway, power the machine back on and reproduce just up to that path’s entrance and capture it — reproducing for the talk doubles as a debrief re-confirming the failure cause.

Wall 2. My script came out 25 minutes long

Symptom: as you write, every stretch looks important.

Cause: "the audience’s 3 things" was fixed late or never. With no deletion criterion, everything survives.

Fix: write the 3 things first, one line each, then number each paragraph of the script with which of 1/2/3 it supports. Paragraphs that can’t be numbered are the cut targets. Still can’t cut? Then that paragraph goes to the write-up, not the talk. Once the division of labor between speech and text is set, the script lightens.

Wall 3. Watching my own recording is too painful

Symptom: you simply cannot bear watching your voice and stumbles.

Cause: everyone feels that way — the discomfort of the first recording viewing is a rite of passage.

Fix: narrow the viewing purpose to one — not "watching myself" but "filling the rubric." Watch at 1.5x filling only the five items and you’re done in 25 minutes. And remember — only the person who endures this discomfort becomes someone who knows "how I sound," and in interviews and team play that difference is overwhelming.

Wall 4. I passed the time attack but explainability scored 0

Symptom: asked "why" for each command, you freeze. It all worked when you solved it.

Cause: lucky passes and understood passes were mixed together — what log debriefs couldn’t catch until now got caught by the explanation exam.

Fix: congratulations are in order — the graduation exam did its job. For each frozen command, reinforce in the order ① confirm the principle in official docs, ② reproduce by powering the machine back on, ③ add one sentence of reason to the script. This reinforcement process itself is this chapter’s biggest learning — the talk is not the goal but the device that completes understanding.

Wall 5. I’m on my fourth re-recording and the score won’t rise

Symptom: points keep coming off the same item.

Cause: in most cases you’re repeating delivery practice without fixing the script. The problem is content (structure, explanation) but you’re fixing expression (speed, intonation).

Fix: classify the rubric’s deduction items by kind — time/structure/evidence are script problems; explainability is an understanding problem. Press the record button only after fixing the script and the understanding. Recording is grading, not practice — practice is fixing the script.

7. Summary

Today’s Concepts

Concept	One-line explanation
Explainability	"You know it only if you can explain it to someone else" — the harshest verification of understanding
8-slide structure	Overview/recon/first judgment/stalls and pivots/foothold chain/privesc/lessons/close
The audience’s 3 things	The sole cutting criterion — supports none of the three, cut
Decisive-moment captures	Screens of discoveries, breakthroughs, stalls — losing scenes are assets too
Self-grading rubric	Time/structure/explainability/evidence/audience care — quantifying explaining power
Rehearsal recording	A one-take exam with no rewind — enduring the discomfort is part of training

Today’s Tools & Formats

Tool/format	What it does
6-kind capture list	The checklist that keeps talk material from being lost mid-assault
8-slide skeleton table	The conversion frame from log to talk structure
The audience’s 3 things	The judgment criterion for script cutting
Self-grading rubric (2 pts each)	The tool that turns recording-viewing into grading
Talk → write-up division	Speech serves the audience’s time; text serves the reader’s reproduction

An Instinct More Important Than Commands

When this check ends, the meaning of the sentence "I broke it" changes. Getting the shell is half; conveying the process in 15 minutes and leaving the audience 3 things is the other half. Skill becomes whole for the first time where these two halves meet.

And this is the live-machine section’s graduation. You can now break a never-before-seen Medium within the time limit and convey the solution in someone else’s language. The next stage is competitions — the clock is faster, teammates stand beside you, and the presentation becomes real-time situation sharing. The two muscles you trained today are the admission ticket to that stage.

Once every box is checked, Step 278 is complete. Click the checkbox in the sidebar to save your progress.