// ● ACTIVE · rev 2026-08-24 — 11 methodology stubs · TryHackMe + HackTheBox · live / growing
// IN PLAIN TERMS — These are practice break-ins on deliberately vulnerable machines — security's equivalent of a flight simulator. Each one is written up as a method, dead ends included, because the repeatable reasoning is what transfers to real work, not the individual trick.
// Methodology First — What This Repository Is — The deliverable here is method, not flags. Each entry documents how a target is approached — what was observed, what was inferred, what was tried, what failed, and what worked — because the reasoning is the part that transfers to a real engagement. The current eleven entries are preparation stubs: structured from publicly documented information about well-known retired rooms, they capture the attack path and methodology without reproducing live flag values or claiming an original solve. They are study scaffolds that become full writeups as each room is worked under account. Failure paths are documented deliberately — understanding why a technique did not apply matters as much as knowing when it does.
Part of the rootdrifter security portfolio.
Platforms
TryHackMe — Structured learning paths and guided rooms. Used for building systematic knowledge of specific techniques — privilege escalation, web exploitation, SMB, Active Directory. Immediate feedback loop.
HackTheBox — Competitive CTF environment with harder, less guided machines. Closer to realistic engagements — the attack surface is defined, but the path from recon to root is not signposted. Builds independent methodology.
Why both? They train different muscles. TryHackMe's guided structure builds coverage — a systematic, named technique catalogue (the foundation you can map to Sec+ objectives). HackTheBox's unguided machines build judgement — choosing a path with no signposts, which is what a real engagement demands. Practising on both means the methodology is neither rote (THM-only) nor unstructured (HTB-only); the writeups apply the same discipline to both so the transferable skill, not the platform, is what shows.
Writeup Index
Eleven structured writeups are in place (7 TryHackMe + 4 HackTheBox). Each is honestly labelled: every entry is currently a preparation stub — a study scaffold built from publicly documented information about well-known retired rooms, with no live flag values recorded. Stubs become full writeups as each box is worked under account. Every writeup carries command-backed recon/enumeration/exploitation sections and a per-machine MITRE ATT&CK technique mapping, tying the offensive steps to the framework a defender would use to detect them.
| Machine | Platform | Difficulty | OS | Attack path | Tools |
|---|---|---|---|---|---|
| Blue | TryHackMe | Easy | Windows | EternalBlue (MS17-010) → SMBv1 → SYSTEM shell → hashdump | nmap, metasploit, hashdump |
| Kenobi | TryHackMe | Easy | Linux | SMB + NFS enumeration → ProFTPD mod_copy path traversal → SUID/PATH privesc | nmap, enum4linux, smbclient, netcat |
| Steel Mountain | TryHackMe | Easy–Medium | Windows | Rejetto HFS 2.3 RCE (CVE-2014-6287) → insecure service binary → SYSTEM | nmap, metasploit, msfvenom, PowerUp.ps1 |
| Alfred | TryHackMe | Easy | Windows | Jenkins default creds → Groovy console RCE → token impersonation | nmap, jenkins, nishang, metasploit |
| Basic Pentesting | TryHackMe | Easy | Linux | SMB enumeration → Samba username disclosure → SSH brute-force → SUID + sudo privesc | nmap, enum4linux, hydra, linpeas |
| Relevant | TryHackMe | Medium | Windows | Anonymous SMB share → base64 creds → writable share served by IIS → .aspx web shell → SeImpersonatePrivilege → SYSTEM | nmap, smbclient, PrintSpoofer/RoguePotato |
| Skynet | TryHackMe | Easy | Linux | Anonymous SMB password list → SquirrelMail login → Cuppa CMS RFI → tar wildcard checkpoint injection in root cron → root | nmap, enum4linux, smbclient, cuppa RFI |
| Lame | HackTheBox | Easy | Linux | Samba 3.0.20 usermap_script (CVE-2007-2447) → direct root; vsftpd 2.3.4 banner ruled out as rabbit hole | nmap, enum4linux, smbclient, metasploit |
| Jerry | HackTheBox | Easy | Windows | Tomcat Manager default creds → malicious WAR deploy → JSP shell → NT AUTHORITY\SYSTEM | nmap, whatweb, msfvenom, curl |
| Bashed | HackTheBox | Easy | Linux | Exposed phpbash web shell under /dev/ → www-data → sudo to scriptmanager → writable script in root cron → root | nmap, gobuster, phpbash, linpeas |
| Beep | HackTheBox | Easy | Linux | Elastix vtigerCRM graph.php LFI → /etc/amportal.conf cleartext creds → password reused on root SSH → root | nmap, curl, LFI, ssh |
// Active — More Writeups Loading — This index grows as challenges are completed. Eleven structured stubs are in place (7 TryHackMe, 4 HackTheBox); pending additions include further TryHackMe rooms (RootMe, Ice, Lian Yu) and HackTheBox machines (Legacy, Devel). Each writeup follows the methodology template in the README — from initial recon to root, with failure paths documented alongside successes, plus a box-specific Wazuh detection rule bridging each machine to the watchtower SIEM lab (companion SIEM lab, in build — publishes when the lab goes public).
ATT&CK Coverage — Techniques at a Glance
The same eleven boxes viewed by MITRE ATT&CK coverage — the primary technique chain each one demonstrates. Every box is currently a preparation stub; a stub becomes a full writeup once the box is solved under account. Together the eleven boxes demonstrate multiple ATT&CK techniques across initial access, execution, privilege escalation, lateral movement, and credential access.
| Box | Platform | Difficulty | Key Technique | ATT&CK | Status |
|---|---|---|---|---|---|
| Blue | TryHackMe | Easy | EternalBlue SMBv1 RCE → SYSTEM | T1210 EternalBlue · T1055.012 process hollowing · T1003.002 SAM dump | Preparation stub |
| Kenobi | TryHackMe | Easy | ProFTPD mod_copy → SUID/PATH privesc | T1190 ProFTPD mod_copy · T1552.004 SSH key theft · T1021.004 SSH lateral · T1548.001 SUID · T1574.007 PATH | Preparation stub |
| Steel Mountain | TryHackMe | Easy–Medium | Rejetto HFS 2.3 RCE → service abuse | T1190 HFS RCE · T1059 command · T1543.003 / T1574.009 service / unquoted path | Preparation stub |
| Alfred | TryHackMe | Easy | Jenkins RCE → token impersonation | T1078.001 default creds · T1059 Groovy RCE · T1134.001 token impersonation | Preparation stub |
| Basic Pentesting | TryHackMe | Easy | SSH key recovery → sudo privesc | T1135 share discovery · T1087 account discovery · T1552.004 SSH key · T1110 brute force · T1021.004 SSH lateral | Preparation stub |
| Lame | HackTheBox | Easy | Samba usermap RCE → direct root | T1190 Samba usermap (CVE-2007-2447) · T1059.004 Unix shell → direct root | Preparation stub |
| Jerry | HackTheBox | Easy | Tomcat WAR deploy → SYSTEM | T1190 Tomcat Manager · T1078 default creds · T1505.003 WAR web shell | Preparation stub |
| Relevant | TryHackMe | Medium | SMB share → aspx RCE → SeImpersonate | T1078 anon SMB creds · T1505.003 aspx web shell · T1134.001 SeImpersonate · T1552.001 creds in file | Preparation stub |
| Skynet | TryHackMe | Easy | Cuppa RFI → tar-wildcard cron → root | T1552.001 leaked creds · T1190 Cuppa RFI · T1059.004 Unix shell · T1053.003 tar-wildcard cron | Preparation stub |
| Bashed | HackTheBox | Easy | phpbash shell → sudo → root cron | T1505.003 phpbash web shell · T1059.004 Unix shell · T1548.003 sudo · T1053.003 root cron | Preparation stub |
| Beep | HackTheBox | Easy | Elastix LFI → password reuse → root SSH | T1190 Elastix LFI · T1552.001 cleartext creds · T1078 / T1021.004 password reuse → root SSH | Preparation stub |
Reading the status honestly. "Preparation stub" is a completeness ceiling by design, not a defect — the methodology, command rationale, ATT&CK mapping, and detection rule are complete; only the live flag values await a solve under account. The internal quality scoring (mean score 8.0, none below 7) is in STUB_AUDIT.md; ATT&CK coverage and the gap backlog are in ATT&CK_GAP_MATRIX.md.
Coverage Radar — Honest Self-Assessment
| Category | Score (/5) | What the eleven stubs actually cover |
|---|---|---|
| NETWORK | 4 | SMB/NFS enumeration and exploitation across six machines (Blue, Kenobi, Basic Pentesting, Lame, Skynet, Relevant). |
| PRIVESC | 3.5 | SUID, sudo abuse, unquoted service paths, token impersonation (SeImpersonate), and writable-cron escalation (Bashed, Skynet). |
| WEB | 3.5 | Jenkins console RCE, HFS CVE-2014-6287, Tomcat WAR deploy, RFI (Skynet/Cuppa), LFI → credential disclosure (Beep), and an .aspx upload-to-execute chain (Relevant). |
| CRYPTO | 1 | Hash dumping and cracking only (hashdump → john/hashcat). |
| FORENSICS | 0.5 | Evidence-logging discipline, no dedicated forensics challenges yet. |
| PWN | 0.5 | Tooling familiarity (gdb, ghidra); no completed binary-exploitation writeups yet. |
Scores reflect the current stub set, not aspiration — the low axes are the practice roadmap, and the chart is redrawn as entries land.
Writeup Structure
Every writeup follows a fixed five-section structure, committed as writeups/<platform>-<machine>.md:
1. Reconnaissance
Initial information gathering — what the target exposes without active interaction. Passive enumeration, OSINT where applicable, and initial network mapping.
2. Enumeration
Active probing of the identified attack surface. Port scanning, service fingerprinting, directory enumeration, user enumeration. Documenting what was found and what was ruled out.
3. Exploitation
The specific vulnerability or misconfiguration used to gain initial access. Includes the decision process: why this vector was chosen, what alternatives were considered, and what failed before the successful approach.
4. Post-Exploitation
Actions taken after initial access: privilege escalation, lateral movement (within scope). Each step documented with the reasoning, not just the output.
5. Lessons Learned
What this machine demonstrated that is applicable beyond the specific challenge. Technique generalisation, tooling notes, and anything that would have shortened the path with better prior knowledge.
Reproducible Enumeration — Commands and Rationale
The methodology is documented in full at methodology/ctf-methodology.md. Key patterns, cited from disk:
Network scan doubles — full-port sweep first, then a targeted service scan on open ports only (ctf-methodology.md §1.1):
# Step 1 — find every open port; -p- avoids the "I missed the service on 8080" miss
nmap -p- --min-rate=1000 -T4 -oN nmap/allports 10.x.x.x
# Step 2 — service + version fingerprinting on known-open ports only
nmap -sC -sV -p<comma,sep,ports> -oN nmap/services 10.x.x.xPer-service depth — what to run after a port is open (ctf-methodology.md §1.2):
| Service | First moves |
|---|---|
| HTTP/HTTPS | whatweb; browse + view source; gobuster/feroxbuster; check robots.txt, default creds, CMS version |
| SMB (139/445) | enum4linux -a; smbclient -L; null-session shares; user enumeration |
| FTP (21) | Banner/version; anonymous login; version-specific exploits (e.g. ProFTPD mod_copy) |
| NFS / rpcbind | showmount -e; mount exports; look for keys/creds |
| DNS (53) | Zone transfer attempt (dig axfr), subdomain discovery |
Evidence integrity — hash artefacts at capture so nothing changes afterwards (ctf-methodology.md §4.3):
sha256sum *.png nmap/* session.log notes.md > evidence.sha256
sha256sum -c evidence.sha256 # re-verify before writing up / archivingScoring rubric — seven criteria, 10-point scale applied in STUB_AUDIT.md §Rubric (STUB_AUDIT.md:14-22):
| Criterion | Weight |
|---|---|
| Recon/enum command-fidelity | 2 |
| Exploitation reasoning | 2 |
| Privesc depth | 1 |
| ATT&CK mapping | 1 |
| Defender perspective | 2 |
| Sec+ exam relevance | 1 |
| Honesty / reproducibility | 1 |
From Offence to Detection — the Blue-Team Half
The target role is SOC analyst, so every offensive step is studied for how it would be caught. This is the deliberate differentiator: most CTF players stop at the flag; this practice continues to "what alert should have fired?" (ctf-methodology.md §11).
For each technique in a writeup, three blue-team questions are answered:
- What log/telemetry records it? (e.g. SSH brute force →
auth.log/ Windows 4625;
service install → Windows Event 7045; new process → Sysmon Event 1; SMB exploit → SMB audit + IDS signature.)
- What would the detection rule look like? A threshold (N failures in M seconds), a
signature (known exploit bytes), or an anomaly (a service binary running from %TEMP%).
- What is the mitigation that removes the vector (patch, config, least privilege)?
Each writeup ships a box-specific Wazuh rule sketch that ties the offensive steps to the detection logic a SOC analyst would use. Those rules are the input to the watchtower SIEM lab (companion lab, in build — publishes when the lab goes public), so the offence→detection loop is demonstrated end-to-end, not asserted.
Connection to spectre: gauntlet builds the methodology and enumeration discipline in isolated lab boxes; spectre applies the same discipline end-to-end in a scoped grey-box engagement (PTES-structured, SHA-256 evidence chain, scope-halt at the ethical boundary). Gauntlet is the drill; spectre is the engagement.
Skills Demonstrated
| Skill | How it shows in the writeups |
|---|---|
| Methodology over shortcuts | A consistent recon → enumeration → exploitation → post-exploitation → lessons structure applied to every box, with failed paths and ruled-out rabbit holes documented (e.g. the vsftpd 2.3.4 decoy on Lame). Knowing why a technique does not apply is the skill that scales to real engagements. |
| Version-to-vulnerability mapping | Reading a service banner (smbd 3.0.20, HttpFileServer 2.3, ProFTPD 1.3.5) and cross-referencing it to a known CVE before touching anything noisy. |
| Both Linux and Windows privilege escalation | SUID/PATH interception and NFS-staged key theft on Linux; unquoted/writable service paths and SeImpersonatePrivilege token impersonation on Windows. |
| Tool fluency and the manual fallback | Metasploit where appropriate, but the manual path documented alongside it — because the manual route builds understanding and works when tooling is disallowed. |
| Blue-team transferability (SOC relevance) | Every writeup maps its offensive steps to MITRE ATT&CK (sub-technique level) and ships a box-specific Wazuh detection rule — the same framework an L1/L2 SOC analyst uses to recognise the activity in logs and EDR telemetry. |
| Cert-to-hands-on mapping | Each writeup carries a Sec+ SY0-701 exam-relevance table — the box made concrete against specific objectives. |
Relevant to: penetration testing / security consulting (offensive methodology and reporting) and SOC analyst roles (attack-technique recognition, ATT&CK fluency, detection mindset).
What CTF Practice Maps To
CTF categories are not abstract puzzles — each one rehearses a capability that a security role uses in the field (ctf-methodology.md §6):
| CTF capability | Real-world equivalent | Role |
|---|---|---|
| Service enumeration and version triage | External attack-surface assessment; vulnerability validation | Pentester · SOC L2 |
| Web exploitation (SQLi, LFI, SSTI) | Application security testing; OWASP-aligned review | AppSec · Pentester |
| Privilege escalation (SUID / sudo / cron / token) | Post-compromise impact assessment; hardening review | Pentester · Red Team |
| SMB / Active Directory enumeration | Internal network assessment; lateral-movement analysis | Red Team · IR |
| Reading exploit code and mapping CVEs | Threat intelligence; exploit triage; patch prioritisation | Threat Intel · SOC |
| Evidence logging and SHA-256 integrity | Chain-of-custody discipline; defensible reporting | DFIR · Consultant |
| Documenting failed paths | Reproducible methodology; report writing | Every security role |
Tool Stack
| Category | Tools |
|---|---|
| Recon / enumeration | nmap, gobuster, ffuf, whatweb, nikto, enum4linux, dig |
| Web exploitation | Burp Suite, sqlmap, manual injection, curl |
| Credentials | hashcat, john, hydra, credential wordlists (rockyou) |
| Privilege escalation | linpeas, winpeas, pspy, GTFOBins, PowerUp.ps1 |
| Post-exploitation | Metasploit (where appropriate), manual shell stabilisation |
| Binary / reversing | gdb, pwndbg, ghidra, objdump, strings |
Methodology Notes
Enumeration Order — Full-port SYN scan → service + version fingerprinting → OS detection → per-service deep enumeration. Web gets Gobuster/ffuf + Nikto. SMB gets enum4linux. Never skip UDP where a UDP service is suspected.
Privilege Escalation — LinPEAS first pass → review SUID/SGID, sudo -l, cron jobs, writable paths, kernel version, service permissions. GTFOBins for SUID/sudo vectors. Always check service account permissions and unquoted service paths (Windows).
Shell Stabilisation — Python pty spawn → export TERM=xterm → stty raw -echo. Tab completion and job control restored. Prevents accidental ctrl-C kills in reverse shells.
Documentation Standard — All commands logged with rationale. Failed attempts documented with the reason they failed. Evidence screenshots where appropriate. Tools listed with purpose, not just name.
Repository
// GitHub — Full writeups, methodology notes, scoring rubric, ATT&CK gap matrix, and templates: github.com/rootdrifter/gauntlet — one repository in the github.com/rootdrifter portfolio.