What is Pwnbox?

Pwnbox is a customized, online Parrot Security Linux distribution with many hacking tools pre-installed. You can use Pwnbox to play in HackTheBox labs without needing to install a local virtual machine (VM). Our custom-made Parrot Security distribution comes equipped with all standard hacking tools, and we issue monthly updates to ensure the software remains fully up-to-date.

Accessing and Initializing Pwnbox

You can access the Pwnbox controls from any page on the HackTheBox website to easily navigate and access your tools. To connect to and initialize a Pwnbox, follow these steps:

Click the Connect button located to the left of your profile picture at the top-right-hand side of your screen.
Select the type of Lab content you intend to play from the menu. Your options include Machines (standalone target systems for testing skills), Starting Point (beginner-friendly boxes to build fundamentals), Pro Labs (realistic corporate network simulations), and Seasonal (competitive tracks on newly released machines).
Select Pwnbox from the list, instead of OpenVPN
Select a Pwnbox Location based on the lowest latency reported for your connection by clicking on the dropdown menu:
Select the VPN Access and VPN Server fields that provide the best latency for you. Keep in mind that if you have a machine already spawned, the option to change these settings will be greyed out, and you will need to terminate your current spawned machine in order to change it.
Click the green Start Pwnbox button to begin the initialization process.

Once your Pwnbox is spawned, you are able to see the amount of time left for that specific instance. By design, Pwnboxes stay up for 8 full hours, and cannot be extended:

If you are a Free user, please remember to stop your Pwnbox to avoid using up your two-hour limit, which cannot be extended once used.

Click the button below to learn more about available content and Lab Access:

Introduction to Lab Access

Available Pwnbox Interactions

After the initialization process for Pwnbox is complete, you will see a small preview of your Pwnbox desktop. You will have three available interaction options:

Open Desktop: This option opens a VNC connection through HTTPS to the box, similar to tools like TeamViewer.
Terminate: This option ends your current Pwnbox instance. It is best practice to terminate your instance when you are finished using your Pwnbox to save time for future use.
Open SSH Terminal: This option initializes an SSH connection from your local machine's terminal. You will be prompted to accept the remote host's fingerprint and enter your generated password, which can be found under the dropdown menu under "View Instance Details", or in the my_credentials.txt file on your Pwnbox's Desktop.

Important Note: Multiple VPN connections may cause instability, so please make sure to disconnect your local VPN from any other locations before you attempt to initialize a VPN connection to HackTheBox labs from Pwnbox, and vice-versa.

Terminating Active Box Instances

You will not be able to change your VPN Access (a US HTB Free or US HTB VIP+ access, for example) and VPN Server (US Machines VIP+ 4, or EU Starting Point Machines VIP 1, for example) of Pwnbox if you already have an active Lab instance running. You must terminate any active Lab instances before changing your Pwnbox access.

If you already have a Lab active/running when you try to spawn your Pwnbox, the VPN Access and VPN Server fields will become unclickable, and only the Pwnbox Location will be changeable:

To terminate any active Lab instances, you can do the following:

Find the currently active Lab on the right side of your search bar, and click on it.
This will bring you to the currently active Lab's page. This is where you can find the "Stop Machine" button on the right side of the screen, under the "Target IP Address" menu.
Once you terminate/stop the active Lab, you will then be able to switch your VPN Access and VPN Server:

How to Find Your Pwnbox Password and Sudo Credentials

During your Pwnbox session, you will need a randomly generated user password to connect through SSH. You won't need your password to run sudo commands, as your user is allowed to run all commands without requiring any passwords.

You can locate your credentials in two different places:

Click the View Instance Details drop-down menu located directly below the Pwnbox statistics section in your Connected button.
Open the my_credentials.txt file located directly on your Pwnbox desktop.

How to Share Your Pwnbox Session with Spectators

You can invite Spectators to view your Pwnbox interaction, which is highly useful for teachers or mentors performing demonstrations. To generate a shareable Spectator Link, click the link icon next to the Instance Lifetime section of the Pwnbox menu.

The Spectator Link won't allow users to interact with your Pwnbox, but only to spectate what you are doing with it.

Using the Pwnbox Interface and Clipboard

Once you click the Open Desktop button, a pop-up page will appear with a loading screen as the VNC connection initializes.

Tools: You can find your main tools, the PowerShell terminal, and the Parrot terminal at the top of the screen.
Workspaces: Next to these tools, you will see shortcuts for Applications, Places, and System folders. You also have a network monitor display and workspace controls.
Clipboard Utility: A clipboard utility is located at the bottom right of the screen. To copy text from your instance to your main OS, first make sure that your Browser allows HTB's Pwnbox VNC to access your Clipboard features. After that, simply copy the text inside the instance, click the clipboard icon, and then paste it outside the instance:
Clipboard Utility (Alternative): Alternatively, after making sure that your Browser is allowing Clipboard access to your VNC, you can simply copy the text from your instance and paste it wherever you would like:

Pwnbox Data Storage and File Transfers via SCP

You can access your personal data on the ~/Desktop/my_data folder. You also have a dedicated user_init script for auto-backups.

To learn more about the my_data folder and the user_init script, please take a look at our "Mastering Pwnbox" article by clicking on the button below.

Mastering Pwnbox

To copy or download anything from or to the Pwnbox instance, you can use SCP. Get your username, hostname, and password using the View instance details button and use the standard SCP command format.

To transfer files to your Pwnbox instance, follow these steps:

Finding your Pwnbox's Public IP: Identify your pwnbox username and ens3 inet IP address using the ip a command:

Command: Open your Host PC's terminal and use the following command to transfer your file:

# Command:
scp {path_to_your_file} {username_on_pnwbox}@{inet_IP_address}:/home/{username_on_pwnbox}

# Example:
scp /home/kali/Desktop/test_file.txt [email protected]:/home/htblxck

Password Requirement when using SCP: If you are asked for a password when attempting to transfer the file, this password can be found on your my_credentials.txt file, or your instance details, as shown previously.
Verify Transfer: Once the command executes, your file should be available in the specified directory on Pwnbox. Here's how the process looks:

To transfer files from your Pwnbox to your machine, you can also use SCP, but if your machine doesn't have SSH configured, you may face some difficulties. The easiest way to transfer files from your Pwnbox to your machine is by using a Python server:

Start your Pwnbox Terminal: Open your Pwnbox's Parrot Terminal
Setting up the server: Set up your Python3 server with the following command:
```
python3 -m http.server -d /path/to/file
```
Starting the server: This will start a Python server on Port 8000 within your Pwnbox, and in the specified directory. Alternatively, you can simply not use the -d option, which will start your Python server in the directory you are currently at on your terminal (which you can verify by using the pwd command):
```
python3 -m http.server
```
Checking Pwnbox's Public IP Address: Verify the IP address on your Pwnbox's ens3 interface using the ip a command:
Download the file: Download the file on your personal machine by opening up a terminal and using wget while specifying the Pwnbox IP address on the ens3 interface, the port used (8000 in this case), and the file you want to download:
```
wget http://138.197.158.63:8000/rockyou.txt.gz
```
Verify the transfer: Once the transfer is done, the file should now be located in the same directory your personal machine's terminal was using when you downloaded the file.

Pwnbox Limitations and Subscriptions

Pwnbox access and limits depend on your specific HackTheBox subscription tier:

HTB Free users: You receive a single, two-hour session of Pwnbox available for the lifetime of your account, so you can test its features. Internet access is not available for free users. To access the internet features (including GitHub access), you will need to purchase an HTB VIP+ subscription.
HTB VIP+ users: You have unlimited use of Pwnbox, and internet access is available.
HTB PRO users: Same as HTB VIP+ — unlimited Pwnbox use with internet access, since HTB PRO includes full HTB VIP+ access.

Introduction to Pwnbox