HackTheBox Phase 7: Capture the Flags

HackTheBox RoadMap — Phase 7: Capture the Flags

The final phase. After escalating to root / Administrator in Part 6, all that's left is to read the flag and close out the engagement. This article also wraps the whole series with a tools reference and a set of Golden Rules.

Reading the Root Flag

 # Linux
cat /root/root.txt

# Windows
type C:\Users\Administrator\Desktop\root.txt

##If the file's name has spaces, wrap it in quotes
type C:\Users\Administrator\Desktop\"this is the root flag.txt"

Real-world notes

Sometimes, we never logged in with a password at the end — we logged in with the Administrator's NT hash (extracted from an AD CS certificate for example) using Pass-the-Hash:

impacket-psexec -hashes :<NThash> administrator@<DC_IP>

## then

type C:\Users\Administrator\Desktop\root.txt

##(evil-winrm -i <ip> -u administrator -H <NThash> works too when WinRM is reachable.)

You rarely need the plaintext password — a hash is a valid credential. And remember the operational gotchas that bit us: the HTB IP changes on every reset (re-check /etc/hosts and your hash if WinRM suddenly times out), and some of the escalation steps were one-shot and irreversible, so get them right before firing.
Let the scan pick the game. The port signature tells you whether you're hunting a web bug or chasing credentials (Part 1).
Enumerate more than you think you need. Open shares, page source, localhost listeners — the foothold is usually sitting in plain sight (Parts 2 & 5).
Version strings are gifts. A build number often maps straight to a known CVE (Part 3).
Abuse features, not just bugs. Management consoles, saved credentials, and trust relationships are the real attack surface (Parts 4 & 6).
When scanners go quiet, read the raw permissions. The best paths are the ones you build from a narrow right, which (no -vulnerable) flag will ever show you (Parts 3 & 6).
A hash is a credential. Pass-the-Hash, DPAPI, and certificates all beat cracking (Parts 5–7).
Mind the clock. Kerberos is time-sensitive (-ntupdate or faketime) saves hours of confusion (Part 6).

That's the full Recon-to-Root in 7 Phases roadmap. Follow it in order on any machine and you'll always know what to do next.

RELATED WRITE-UPS

HackTheBox RoadMap — Phase 6: Privilege Escalation

Part 6 of the HackTheBox RoadMap. The payoff phase: escalating from a normal user to root on Linux or Domain Admin / SYSTEM on Windows. Covers sudo, SUID and cron abuse, group-based paths, Windows token privileges and service misconfigurations, plus a full Active Directory and AD CS escalation chain from the DanglingTree box.

HackTheBox RoadMap — Phase 5: Post-Exploitation / Local Enumeration

Part 5 of the HackTheBox RoadMap. With a shell in hand, this phase walks through enumerating the box from the inside — users, sudo rights, SUID binaries, cron jobs and hidden credentials — across Linux, Docker containers and Windows. Includes real DPAPI and credential-chaining lessons from the DanglingTree box.

HackTheBox RoadMap — Phase 4: Exploitation / Initial Access

Part 4 of the HackTheBox RoadMap. This phase covers turning a confirmed vulnerability into a working shell: starting a listener, delivering a reverse-shell payload, and stabilising the session. Includes real lessons from the DanglingTree box on abusing management interfaces and pivoting to localhost-only services.

HackTheBox RoadMap — Phase 3: Vulnerability Identification

Part 3 of the HackTheBox RoadMap. This phase turns your scan and enumeration results into real attack vectors: you match service versions to known exploits with searchsploit, then test for SQLi, LFI/RFI, command injection, SSTI, XXE and common misconfigurations, with real lessons from the DanglingTree box.

HackTheBox RoadMap — Phase 2: Service Enumeration

Part 2 of the HackTheBox RoadMap series — the phase where you spend the most time. This guide covers enumerating every open service: HTTP/HTTPS manual checks, directory brute-forcing with gobuster and ffuf, six subdomain-discovery methods, and probing FTP, SSH, SMB, DNS, SNMP, MySQL, Redis, and WinRM — plus a real-world note from the DanglingTree box on how an anonymous SMB share leaked the foothold.

HackTheBox RoadMap — Phase 1: Reconnaissance (Port Scanning)

Part 1 of the HackTheBox RoadMap series — a structured, repeatable methodology for solving any HTB machine. This phase covers reconnaissance: discovering every open port and service with Nmap (fast, full, and UDP scans), reading the port signature, and plus a real-world note from the DanglingTree box on how the scan alone decides your entire playbook.