Post cover image
"The automated Aeternum Sec consulting dashboard running seamlessly inside the terminal context."

October 17, 2026

Stop Taking Loose Notes: Building a Real-Time Consulting Engine for Hack The Box

Hello Internet, as today’s title says, we are in the automation timeline; might as well start. Now, all creds go to Tadi at Navigating…

By Emmanuel Wiseman

5 min read

Hello Internet, as today's title says, we are in the automation timeline; might as well start. Now, all creds go to Tadi at Navigating Security (check out his video: How to turn CTF machines into a pentest portfolio) — he really made me think I can do better, and better I shall. I shall also give special thanks to GrepStrength, who gave me some excellent pointers, and I am incredibly grateful for that.

Normally, everyone writes a CTF write-up, and yes, they are pretty good and great (10:05). But they are not devising what may go down when actually running a live pentest engagement (1:05). Tadi made me have an epiphany of how best I can solve this gap in 4 distinct ways:

  1. Professionalism: No company is gonna trust a hacker if they don't give off a sense of decorum (9:05). If I'm being candidly honest, most people still don't understand what a hacker is other than what the media has taught them. We are in the business of protecting people from themselves and others, and nobody likes to pay to be told that… just saying (1:30).
  2. Replicability: I needed a system that scales cleanly for all HTB machines going forward, regardless of the box target or framework (2:41).
  3. Time-Saving: The video provided 2 excellent templates (the Statement of Work and the Penetration Testing Report). I wanted a system that automates the setup of these deliverables so I never have to spend hours formatting headers post-compromise (6:44).
  4. The Ultimate Mix: Take the real-world consulting templates, merge them with what I consider a highly replicable layout for HTB machines, create a fictitious security company of my own (Aeternum Sec), and mix them all up inside an automated Linux pipeline (2:18).

Operating inside an Arch Linux VM running Athena OS, here is exactly how I built a multi-template shell script engine to achieve this.

Phase 1: The centralized Blueprint Repository

To make the environment completely replicable, I avoided scattering files around my system. I mapped out a hidden configuration folder to house my master templates permanently:

mkdir -p ~/.config/aeternumsec
mkdir -p ~/AeternumSec/HTB_Labs

So, inside the ~/.config/aeternumsec, I added three hyper-professional corporate markdown master files:

  • infra.md -> Tailored for Standalone Network infrastructure & Active Directory Pro Labs (2:34).
  • pipeline.md -> Optimized for DevSecOps pipelines and automation runner environments.
  • code.md -> Structured for secure source code review and static analysis workflows (SAST).

If you type ls -la ~/.config/aeternumsec/ you will see this:

None

Phase 2: Building the Dynamic Script Engine

Then came the automation logic. Wrote a bash script (new_box.sh) that takes three simple inputs: the target name, the target network locator (IP or file path), and the style of hack I am executing.

nano ~/.config/aeternumsec/new_box.sh

Here is the exact source code running on my system:

#!/bin/bash
# Help validation check
if [ -z "$1" ] || [ -z "$2" ] || [ -z "$3" ]; then
 echo -e "\e[31m[-] Error: Missing required structural arguments.\e[0m"
 echo -e "\e[33m[!] Operational Usage:\e[0m"
 echo -e " newbox <Target_Name> <Target_IP_or_Repo> <Type>"
 echo -e "\e[34m[*] Available Types:\e[0m"
 echo -e " infra -> Network Infrastructure, Standalone Boxes & Active Directory Labs"
 echo -e " pipeline -> DevSecOps, Automation Runners, and CI/CD Workflow Reviews"
 echo -e " code -> Secure Source Code Review & Static Analysis (SAST)"
 return 1 2>/dev/null || exit 1
fi
NAME=$(echo "$1" | tr '[:upper:]' '[:lower:]')
TARGET_VAL="$2"
TYPE=$(echo "$3" | tr '[:upper:]' '[:lower:]')
WORKDIR="$HOME/AeternumSec/HTB_Labs/$NAME"
# Route template mapping dynamically
case "$TYPE" in
 infra)
 TEMPLATE="$HOME/.config/aeternumsec/infra.md"
 ;;
 pipeline)
 TEMPLATE="$HOME/.config/aeternumsec/pipeline.md"
 ;;
 code)
 TEMPLATE="$HOME/.config/aeternumsec/code.md"
 ;;
 *)
 echo -e "\e[31m[-] Error: Invalid assessment type: '$TYPE'\e[0m"
 return 1 2>/dev/null || exit 1
 ;;
esac
# Directory collision safety check
if [ -d "$WORKDIR" ]; then
 echo -e "\e[31m[-] Operational workspace directory already exists for: $NAME\e[0m"
 cd "$WORKDIR"
 return 0 2>/dev/null || exit 0
fi
# Check if master template exists before trying to build directories
if [ ! -f "$TEMPLATE" ]; then
 echo -e "\e[31m[-] Error: Master template file not found at: $TEMPLATE\e[0m"
 echo -e "\e[33m[!] Please create this master template file before running the script.\e[0m"
 return 1 2>/dev/null || exit 1
fi
# Build standardized engagement directory infrastructure
mkdir -p "$WORKDIR"/{nmap,exploits,evidence,loot}
# Calculate dynamic template variables
CURRENT_DATE=$(date +"%d %B %Y")
CURRENT_YEAR=$(date +"%Y")
RANDOM_ID=$(shuf -i 1000–9999 -n 1)
# Hydrate the targeted markdown document with project variables using ':' as delimiter
sed -e "s:{{MACHINE_NAME}}:$1:g" \
 -e "s:{{MACHINE_IP}}:$TARGET_VAL:g" \
 -e "s:{{DATE}}:$CURRENT_DATE:g" \
 -e "s:{{YEAR}}:$CURRENT_YEAR:g" \
 -e "s:{{RANDOM_ID}}:$RANDOM_ID:g" \
 "$TEMPLATE" > "$WORKDIR/findings_report.md"
echo -e "\e[32m[+] $TYPE Assessment Workspace initialized for Aeternum Sec.\e[0m"
echo -e "\e[34m[*] Path:\e[0m $WORKDIR"
echo -e "\e[34m[*] Report:\e[0m $WORKDIR/findings_report.md"
# Automatically step into the target environment safely
cd "$WORKDIR"
# Instantly render the polished Aeternum Sec report on screen
glow findings_report.md

The Crucial Technical Lesson: Overcoming the sed Delimiter Trap

Of course, there was an error with the DevSecOps lab template lab path such as the (/src/workflows/) when i ran it the script crashed my termianl shell as soon as i typed in newbox as newbox is the alias.

I learned that standard linux string replacements rely on tradational forward-slash syntax (s/search/replace/g). But when your target input variable contains its own native directory slashes, sed panics, misreads the paths as command directives, and throws an unknown option error.

The solution change from / to | so using alternate colons (s:search:replace:g) as custom delimiters, now it works the engine shows no errors as it can dynamically inject complex repository URLs, absolute local Linux directory trees, or standard IP scopes into the report headers without a single configuration clash.

Phase 3: Global Terminal Hook & Shell Integration

To make this engine fast to execute, just load the automation path directly into your primary environment runtime sheets. This is the alias as i mentioned earlier in phase 2

echo "alias newbox='source ~/.config/aeternumsec/new_box.sh'" >> ~/.zshrc
source ~/.zshrc

To ensure that the alias is doing what i should without breaking any environment runtime variables, a quick validation check can confirm this

tail -n 1 ~/.zshrc
None

Phase 4: Live Execution & Visual Payoff

So with all that working seamlessly, now if you launch a pipeline verification drill, teh environment should automatically seperate the output directories (nmap/, loot/), formats like file metadata parameters, navigate the prompt and pipes directly into the glow markdown render. NB:// I forgot to mention you have to install glow then add it to the new_box source code.

Embedded content

None

as you can see this shows i already have one so let me show you how it looks when i delete it:

None None

At the end, this is what it should look like:

cat ~/AeternumSec/HTB_Labs/pipeline_test/findings_report.md | head -n 25
None

By no way was this easy, but it was fun to accomplish. Till next time, may you always be in a state of flow.

References & Resources

  • Core Methodology: To see how to pivot your standard CTF write-ups into professional, high-value consulting artifacts, review the original framework overview by Navigating Security: How to turn CTF machines into a pentest portfolio.
  • Platform Distro: Learn more about the advanced, cybersecurity-tailored operating system layout running this engine at the Athena OS Project Home.
  • Terminal Interface: Render your own text structures with beautiful colors and interactive visual layout designs using Glow by Charm.