HTB: twomillion Writeup (Incomplete)

Status Notice

⚠️ INCOMPLETE WRITEUP - This writeup is a skeleton with minimal documentation. Only the user flag has been captured. Investigation notes for most sections are pending.

Machine Information

Summary

twomillion is an Easy-difficulty Linux machine from HackTheBox. Standard exploitation path expected: initial enumeration → service discovery → initial foothold → privilege escalation to user → privilege escalation to root.

Current Status: User flag captured. Root flag and detailed exploitation steps pending documentation.

Reconnaissance

Port Scanning

nmap -sC -sV -T4 -p- 10.129.x.x

Investigation Pending: Port scan results not documented.

Service Enumeration

Hostname: 2million.htb

echo "10.129.x.x 2million.htb" >> /etc/hosts

Investigation Pending: Service enumeration details not documented.

Initial Foothold

Investigation Pending:

• Exploitation vector not documented
• Entry point methodology not recorded
• Initial access method unknown

User Compromise

User Flag

🚩 User Flag (Captured): 57a85413575d3901b55353d87cd1f91e

Exploitation Details

Investigation Pending: Method to obtain user flag not documented.

Privilege Escalation

Path to Root

Investigation Pending: Privilege escalation technique not documented.

Root Flag

Status: Not captured

Investigation Pending:

• Root exploitation methodology unknown
• Root flag not yet obtained

Tools Used

Note: Tool list is incomplete and based on template.

Next Steps to Complete This Writeup

1. Document all nmap scan results and open ports
2. Record service enumeration findings
3. Detail initial foothold exploitation steps and payloads
4. Document user credential discovery methodology
5. Capture root flag
6. Document privilege escalation chain
7. Create attack chain diagram when complete
8. Add actual key learnings from exploitation

Disclaimer

This writeup is for educational purposes only. All activities described were performed in a controlled, legal environment (HackTheBox platform). Unauthorized access to computer systems is illegal.

Last Updated: 08 Mar 2026

Documentation Status: Skeleton/Incomplete - User flag only

Tags: #HackTheBox #Linux #Easy #Incomplete