A Hard-rated Linux machine | Hack The Box Season 12
Machine Information
Hack The Box
Linux
Hard
ctrlzero
31 October 2026
01 November 2026
#59
1105 XP
Want more detailed walkthroughs, writeups, and cybersecurity content?
Network Reconnaissance →
Service Enumeration →
Attack Surface Analysis →
Vulnerability Identification →
Initial Access →
Linux User Enumeration →
Privilege Escalation Analysis →
Root Access
HTB Takeoff is a Hard-rated Linux machine from Hack The Box Season 12, created by ctrlzero. The machine provided an opportunity to apply a structured penetration-testing methodology, covering network reconnaissance, service enumeration, vulnerability analysis, initial access and Linux privilege escalation.
I approached Takeoff methodically, starting with basic network discovery and gradually narrowing down the potential attack surface. Instead of rushing into exploitation, I focused on understanding the exposed services, examining interesting behaviour and correlating the information collected during enumeration.
After working through the attack path and overcoming several obstacles, I successfully established access to the target system and completed the machine, obtaining the required privileges.
Important Note: This walkthrough focuses on the methodology and learning experience. Target IP addresses, credentials, passwords and flags are intentionally omitted. All testing should be performed within authorised environments such as Hack The Box.
Table of Contents
01. Initial Reconnaissance
As with every Hack The Box machine, I started by confirming connectivity to the target system. Before beginning any detailed investigation, it is important to establish that the machine is reachable from the lab environment.
A simple connectivity check using ping helped verify communication with the target.
ping -c 4 <TARGET_IP>Once connectivity was confirmed, I moved on to network reconnaissance using Nmap. The primary objective was to identify exposed ports, discover running services and understand the initial attack surface.
nmap <TARGET_IP>The initial scan provided a starting point for further investigation. I then expanded the enumeration to collect more information about the services exposed by the target.
Key Insight: Initial reconnaissance is about building an accurate picture of the target. Understanding the exposed attack surface is more valuable than immediately attempting exploitation.
02. Enumeration and Attack Surface Analysis
With the initial reconnaissance complete, I moved into a more detailed examination of the available services.
I approached each discovered service independently, looking for useful information, unusual configurations, accessible resources and potential security weaknesses.
One of the important aspects of this stage was understanding how individual findings could relate to one another. A seemingly minor observation can become significant when combined with information gathered elsewhere in the environment.
I documented potentially useful findings and revisited earlier observations as the investigation progressed. This helped narrow down the possibilities and identify a promising direction for the next stage.
Lesson: Effective enumeration requires patience. Rather than relying on individual service banners or assumptions, correlate findings and investigate how different components interact.
Want more detailed walkthroughs, writeups, and cybersecurity content?
03. Initial Access
After analysing the available attack surface, I identified a promising direction for further investigation.
The initial foothold required a closer understanding of the exposed functionality and recognising the security weakness that could be leveraged.
Rather than proceeding based on assumptions, I validated the observations and ensured that the identified behaviour was reproducible and relevant to the attack path.
After working through the identified weakness, I successfully established initial access to the target Linux system.
Key Insight: Initial access is not the end of the assessment. It is the beginning of understanding the internal environment and identifying what additional privileges or access may be available.
04. User-Level Access
Obtaining an initial foothold was only one part of the challenge. I continued by examining the environment available to the compromised account.
The focus shifted towards understanding the current user's permissions, accessible resources, system configuration and other details that could help identify opportunities for further access.
Linux enumeration played an important role here. I paid attention to the environment and examined information that could reveal weaknesses in the system's security boundaries.
This stage helped establish a clearer understanding of the system and provided the necessary context for investigating privilege escalation.
Lesson: After obtaining a foothold, always reassess the environment from the perspective of the compromised user. Permissions, accessible files and local services can reveal opportunities that were not visible during external reconnaissance.
05. Privilege Escalation
The final major stage involved investigating potential privilege escalation opportunities within the Linux environment.
I examined the system configuration, available permissions, running processes and other relevant components that could potentially introduce a privilege escalation path.
Instead of relying on assumptions, I focused on validating potential weaknesses and understanding how they could be leveraged within the current environment.
After identifying and successfully leveraging the relevant privilege escalation path, I obtained root-level access to the machine.
Critical Milestone: Root access confirmed. The final stage demonstrated the importance of understanding Linux permissions, system configuration and the security implications of privileged components.
06. Machine Completion
With administrative access successfully established, I verified the final privilege level and confirmed that the machine had been completed.
Takeoff was a valuable exercise in structured reconnaissance, service analysis, vulnerability identification and Linux privilege escalation.
The machine required a methodical approach and reinforced the importance of understanding the target environment before deciding on the next step.
Machine Successfully Completed
HTB Takeoff
01 November 2026
Want more detailed walkthroughs, writeups, and cybersecurity content?
07. Key Takeaways
- Structured reconnaissance provides a foundation for identifying and understanding the target's attack surface.
- Service enumeration should focus on understanding functionality, configurations and potential weaknesses.
- Individual findings become more valuable when correlated with other observations.
- Initial access is only the first step. Internal enumeration is essential for understanding the compromised environment.
- Linux permissions, running processes and system configurations are important areas to investigate during privilege escalation.
- Validating potential weaknesses is more reliable than relying on assumptions.
- A methodical penetration-testing approach helps connect different findings into a complete attack path.
Want more detailed walkthroughs, writeups, and cybersecurity content?
08. Conclusion
HTB Takeoff was a challenging and rewarding addition to my Hack The Box journey. Its Hard difficulty made the experience particularly satisfying, especially because completing it required patience, careful enumeration and a structured approach to problem-solving.
The machine reinforced an important principle of penetration testing: successful exploitation is not simply about finding a vulnerability. It is about understanding the environment, connecting individual findings and validating each step before moving forward.
From initial network reconnaissance to obtaining root-level access, the experience provided another opportunity to strengthen my practical Linux security and penetration-testing skills.
My biggest takeaway was simple: good enumeration and analytical thinking often make the difference between getting stuck and finding the intended attack path.
Another machine completed, another set of lessons learned, and another step forward in the cybersecurity journey.
HTB Takeoff Writeup
Linux · Hack The Box · Season 12 · Hard · Reconnaissance · Enumeration · Initial Access · Privilege Escalation
More Hack The Box walkthroughs and cybersecurity learning resources are available through CyberMaster.