The shape of every box

7 min read

A box looks open-ended but almost always follows the same arc. Knowing the arc is what stops you staring at an IP with no idea what to do.

1. Enumerate. The single most important phase, and the one beginners rush. Full port scan, then service and version detection on what is open, then dig into each service — web dirs, shares, banners. Enumeration is not a step you finish; it is the step you return to every time you are stuck. Ninety percent of "I'm stuck" is "I stopped enumerating too early".
2. Find the foothold. One service has a way in — a known CVE, a default credential, an upload, an injection, an exposed panel. Turn it into code execution as some low-privilege user.
3. Get a shell & stabilise. Trade your foothold for an interactive shell, upgrade it to a real TTY, and grab the user flag.
4. Privilege-escalate. Enumerate again, now from inside: sudo rights, SUID binaries, cron jobs, writable files, kernel version, stored credentials. One of them lets a normal user become root.
5. Root & loot. Grab the root flag, and understand the whole chain well enough to write it up.

Two habits separate people who root boxes from people who get stuck: take notes as you go (every port, credential, and version — you will need something from step 1 at step 4), and when stuck, enumerate the thing you skimmed. The answer is almost always in output you already generated and did not read closely.