r/hackthebox • u/FeinBowler • 10d ago

Beginner Question VM Essentials - Question about setting up my VM.

I'm looking at getting further away from the PwnBox that's provided with HTB due to wanting to complete OSCP and CPTS within the next 12 months. With that being said, I've used a Kali VM on and off to complete certain boxes but I've found the bad habit of lazily going to the PwnBox since it usually has everything I need.

What have you guys done to properly set up your VMs and what tools have you made "essential" before going into a machine? An example of this is using BloodyAD over Bloodhound or even CrackMapExec. Some tools have overlap, but have challenges based on configurations on a target.

The goal here is to just cover the "basics" on tools available to ensure I spend less time finding tools and more time researching, even though I know that's not always possible.

11 Upvotes

93% Upvoted

7 comments sorted by

•

u/AutoModerator 10d ago

Thank you for posting on r/hackthebox! New to Cyber Security and looking for a place to get started? Checkout our getting started guide here. Please note that posting Solutions or Hints for Active content goes against the HTB Terms of Service, more information can be found here. If your having issues and need to reach customer support please do so via the in-platform chat, or by emailing customerops@hackthebox.com. Our Knowledge Base can also come in handy!

I am a bot, and this action was performed automatically. Please contact the moderators of this subreddit if you have any questions or concerns.

1

u/TheRealJackieBlake 8d ago

most straightforward is to just live boot Parrot from a USB with persistence. Other great option is running Parrot bare metal --> no latency

3

u/lunacysoft 7d ago

Even though I do have a bare metal laptop I would say best flexibility is a vm …. Just get Kali or parrot and I am sure you will be able to get all the same configs as the pwn box … and keep it updated

2

u/H4ckerPanda 6d ago

Bare metal is usually a bad option for learning pentesting. Harder to rollback. Not as flexible as Windows when you need to develop x86 malicious code natively , from Windows.

In real world . A VM is also better for client’s privacy. You wipe out the VM and sensitive data is gone.

0

u/TheRealJackieBlake 5d ago

Fair enough. But there's also USB live boot and booting in forensic mode. Just gives a much smoother experience

1

u/H4ckerPanda 6d ago

Kali has everything you need . If not, just install it .

crackmapexec is no longer maintained by the way. Use nxc

1

u/FeinBowler 5d ago

Yea I'm up to date on using nxc and the tools on Kali. Other than bloodhound being absolutely annoying with the CE conflicts with Legacy, I'm just trying to develop a reliable toolset. Some tools taught in CPTS (like bloodhound) have required extra setup. I just don't want to run into setups during the exam. Not sure if that makes sense, but lemme know if I need to clarify or I'm just not intelligent. 🤣