CTF Walkthrough: Beginner Box
Capture The Flag competitions are the best way to practice ethical hacking in a legal, gamified environment. You will work through a beginner-level CTF box step by step, applying reconnaissance, scanning, exploitation, and privilege escalation techniques in a realistic scenario. This lesson ties together everything you have learned so far.
Learning Objectives — Deep Dive
Each objective below is broken down into plain English so you know exactly what you are learning, why it matters, and what you will be able to do when you are done. Mark each one complete as you work through the lesson.
Set up your VPN connection to the practice platform
Create accounts on both TryHackMe (tryhackme.com) and HackTheBox (hackthebox.com) — they have different strengths and you will use both throughout your career. Download the OpenVPN configuration file from your account settings on whichever platform you are using today and connect from Kali using the openvpn command. Verify connectivity by pinging the target machine IP after connecting — if you can ping the VPN gateway but not the target machine, try disconnecting and reconnecting the VPN. Keep the VPN terminal window open in a separate tmux pane throughout the exercise so you can monitor the connection status.
sudo openvpn ~/Downloads/platform-vpn.ovpnSelect an appropriate beginner machine and read the description
On TryHackMe, start with Basic Pentesting or Vulnversity — both are designed for beginners and have structured hints available. On HackTheBox, filter by Retired machines and sort by difficulty, starting with Lame (Linux, Easy) which has a well-known Samba exploit. Read the machine description carefully before starting — it often contains subtle hints about the attack vector. Note the operating system (Linux vs Windows) because this affects your post-exploitation approach significantly. Set a timer for 2 hours — if you are completely stuck after 2 hours, it is acceptable to read a hint or walkthrough, but try to understand why the solution works rather than just copying commands.
Apply your full reconnaissance methodology systematically
Resist the urge to jump straight to exploitation — proper recon is what makes the difference between a successful and failed attempt. Start with a ping to confirm the target is alive, then run a quick Nmap scan of the top 1000 ports to get initial results fast, then run a comprehensive full-port scan in the background while you investigate the initial findings. For each open service, note the exact version number and immediately search for known vulnerabilities. On web services (port 80/443), also run gobuster or dirb to enumerate directories and files — many CTF machines hide the attack vector in a non-obvious directory that automated scanners find quickly.
ping -c 3 TARGET_IP && sudo nmap -sV -p 1-1000 TARGET_IPResearch vulnerabilities and build your attack plan
For each service version found, run searchsploit to find local exploit database entries and search exploit-db.com online for additional options. Also search the CVE number directly in Metasploit using the search command to find available modules. Build a prioritized attack plan listing each potential attack vector, the exploit you would use, the expected access level if successful, and the reliability rating. Start with the highest-reliability, highest-impact vector — a common beginner mistake is trying the most complex exploit first when a simple, reliable one is available. If the machine has a web application, also manually browse it and look for login forms, file upload functionality, and obvious injection points before running automated tools.
searchsploit [service] [version]Execute your attack plan and document each attempt
Work through your prioritized attack list methodically, and for each attempt write down: what you tried, the exact command or module used, what happened (success, failure, error message), and your hypothesis about why it failed. This documentation habit is critical — it prevents you from trying the same thing twice and helps you spot patterns in what is and is not working. When an exploit fails, read the error message carefully because it often tells you exactly what is wrong (wrong target version, firewall blocking the port, missing dependency). If you get a shell, immediately run your enumeration commands before doing anything else — shells can be unstable and you want to capture as much information as possible before it drops.
Escalate to root and write your complete attack narrative
After getting user-level access, enumerate the system for privilege escalation paths using the techniques from the post-exploitation lesson. On Linux machines, check sudo -l, SUID binaries, writable cron jobs, and kernel version. On Windows machines, check for unquoted service paths, weak service permissions, and stored credentials. Once you have root or Administrator access, find and read the flag files (typically /root/root.txt on Linux). Write a complete attack narrative covering every step from initial recon to root — this is excellent practice for real penetration test reports and builds your professional portfolio.
sudo -l && find / -perm -4000 2>/dev/null && cat /root/root.txt