tryhackme.com is a website containing cyber security problems/questions.

Try Hack Me is organized into rooms that might have many problems relating to a central theme. To attempt the problems, one needs to open a connection to AttackBox, a web-based connection to a Kali machine. Alternatively you can use OpenVPN. For free users there exists a time limit on using the machine, but people with subscriptions, it is unlimited max machine open is 3.

1. Start with the tutorial which will help you set up
2. Next do an easy challenges such as Vulnversity although this one is a bit long and something like Web Fundamentals might be easier
3. Do some more easy/tutorial ones to get your feet wet

1. Tutorial
2. How to use TryHackMe
3. Welcome
4. OpenVPN
5. Web Fundamentals
6. Intro to Python
7. Burp Suite
8. Linux Series (1-3)
   1. Part 1
   2. Part 2
   3. Part 3
9. Windows Intro
10. Google Dorking
11. How Websites Work
12. Introductory Networking
13. Hashing - Crypto 101
14. Intro Shells
15. Nmap
16. Hydra
17. HTTP in detail
18. Putting it all together
19. Active Directory Basics
20. John the Ripper
21. Common Linux Privesc
22. Metasploit
23. Encryption - Crypto 101
24. Linux PrivEsc
25. DNS in Detail
26. Vulnversity
27. Network Services
28. Network Services 2
29. OhSINT
30. OWASP Top 10
31. OWASP Juice Shop
32. Upload Vulnerabilities
33. Kenobi
34. Basic Pentesting
35. Mr Robot CTF
36. Blue
37. Ice
38. Steel Mountain
39. Nessus
40. Pickle Rick
41. Wireshark 101
42. Attacktive Directory
43. Post-Exploitation Basics
44. Attacking Kerberos
45. Introduction to Django

1. Start a machine, this will take ~ 1-2 minutes for pro accounts
2. (Recommended) have two windows if 2+ monitors, 1 for Kali Linux window and another for the instructions
3. Follow instructions to get the flag and submit it

Similar to Tutorial (above), however you don't need to do Start AttackBox

A nice intro to TryHackMe

1. Download OpenVPN and install it
2. Download the configuration files from TryHackMe
3. Load the config file onto OpenVPN
4. Connect
5. ssh into server

Good place to start out

Instead of using curl in the command line, using postman to send requests might be easier

Trivial

Do for last step (* note txt is the text file containing the task file)

import base64

with open("txt", "r") as fp:
    flag = f.read()

for i in range(5):
    flag = base64.b16decode(flag)

for i in range(5):
    flag = base64.b32decode(flag)

for i in range(5):
    flag = base64.b64decode(flag)

print(flag)

Then run with python3 t.py or whatever you named your python file

Follow instructions, mostly straight forward

Task 6 (some step in the middle) the question that starts with "Return to your web browser and navigate to the web application hosted on the VM we deployed just a bit ago", this web application is deployed/started in Task 6 (show below)

The URL to enter is the one at the top of the page in a red box (see below)

Simple and easy -> do it in any Linux distro except for Task 9, but that's just my friend pinguftw for the answer if you can't be bothered to run the binary :p

* Remember to start the machine (which is different from the attack box)

This one has a lot of useful information and here are some that I did not know:

• ; operator is the same as && but does not need to execute successfully

This part goes through some more tools and commands for us to go into.

Task 7 -> find / -name shiba4 2>/dev/null (idk what 2>/dev/null does but it works)

A simple intro to the Windows operating system. This barely counts as a room, but it is what it is.

Google, SEO, and indexing!

Notice for me:

Easy intro into web dev and how websites work

Networking stuff (Mostly IT/network stuff)

Intro cryptography

Task 4, Last question -> check length with Python

len("HASH")

For Task 5, to crack, use

hashcat -m NUM hash rockyou.txt where hash is the txt file containing the hash and change NUM to whatever the code for your hash type (found here: https://hashcat.net/wiki/doku.php?id=example_hashes). Also note that rockyou.txt was saved in the same directory level as the hash file

* Note this may take a while

You can do the questions in order, but a better idea is to go to the bottom (task 14/15), start those machines and test the other tests with the open machine while AttackBox is open

Task 3 -> recommended to redirect output to text file like this

nmap -h > t.txt then grep the output of the t.txt to find the answer like this

cat t.txt | grep -in -e 'FIND TEXT'

To get the answers most of the time and line number if you do not find it immediately

Nice and simple intro to Hydra (you can use Burp for intercept)

* note the usual word list rock you and it is found in /usr/share/wordlists/rockyou.txt on the attack box by default

Some simple questions to get you to know HTTP and the web

Now with the other modules completed, put it all together and finish the quiz, good luck!

Reading assignment 😩

(Don't be afraid to use the hint for the second last part)

Use rockyou.com for test: rockyou.txt wordlist

For cracking in task 4, use john hashX.txt --wordlist=../rockyou.txt if rockyou.txt is in the directory above yours

In Task 9-11, zip2john, rar2john, and ssh2john are not found so install it manually or just enter

pass123 as the passcode zip and

password for the rar (you also need unrar)

mango for the ssh key

This video series covers this room in great detail: https://www.youtube.com/watch?v=PjjuZwVvCgc

Follow the steps and/or watch the video (which contain the answers)

Task 4 -> use python interrater

Good resource for escalation later on (definitely a good bookmark)

Find out what a DNS is

1. Run nmap -A -sC -p- -oN vul.nmap 10.10.IP ADDRESS HERE* on the instance of Kali

2. Wait >10 minutes for it to resolve

3. Scan for hidden files by doing gobuster dir -u http://<ip>:3333 -w /usr/share/wordlists

4. Go to the <ip>/internal/index.html on firefox (Make sure u aren't using http or https before the url)

5. Follow the rest of the steps till yo get to injecting the PHP code

6. Make sure download the PHP file from GitHub, rename it to be a .phtml and change the IP to the TMP IP address

   

7. Save, upload, listen, then submit file

8. Then the netcat should allow you in such that you can gain control and find out things about the machine

9. Follow https://n0w4n.nl/vulnversity/#crayon-60458bd07482b875406373 to gain admin privileges

10. Follow the rest of the instructions and you should be done! 🥳

Resources:

• https://n0w4n.nl/vulnversity/
• https://www.youtube.com/watch?v=hvYWCegfEZs&ab_channel=JohnHammond

see YouTube 1, YouTube 2, or YouTube 3 for hints

/usr/sbin/showmount is just showmount (Task 3)

Some parts maybe broken like the MySQL (also need to install MySQL)

A very good writeup: http://wuvel.net/network-services-2/#:~:text=What%20process%20allows%20an%20NFS,Mounting.

MSINT fun. Do some googling and don't be afraid of using the hint

For SSID of WAP, the website has changed the the answer is UnileverWiFi

Last question requires you to look in the source code (under the header)

Follow the steps till task 7, where the arthur task might be broken. Therefore the password is d9ac0f7b4fda460ac3edeb75d75e16e

In severity 3, you go into SQL. Notes on SQLite3:

• find the structure of the table with .schema TABLE_NAME in sqlite3

SSH key is usually located at /home/falcon/.ssh/id_ra

In take 16, it can be annoying to get the first 18 characters so use python by specifying

a = "KEY"
print(a[:18])

Severity 6: MSINT

Severity 7: Note that the alert must be case sensitive (ie Hello)

Severity 8: Task 21 is a trick question since it's the Apache Software Foundation 🙄

also note the first flag (cookie) requires a decoder

Note the best1050 wordlist from task 4 exists in /usr/share/wordlists/SecLists/Passwords/Common-Credentials (also that question takes a long time because burp wants you to buy premium)

Make sure you follow tasks 1 otherwise, the website will not work. In addition, when entering the website via firefox, if it is not showing the website and redirecting to Google, please do overwrite.uploadvulns.thm/ (with the slash). Follow the steps and have fun with the challenge!

Follow the steps are the rest is trivial

Check The video (https://www.youtube.com/watch?v=xl2Xx5YOKcI)

This room should be done near the end because it requires a bunch of other tools and it requires you know how to pentest starting from nothing

This is similar to Blue, or at least the steps are the same, just some praxis

The behaviour of msfconsole may vary on your machine and therefore you may have to background once you do run. Sometimes the run will fail and you may need to restart the machine

(This room is a bit finicky)

1561 is the one we want in task 3

Here I will break down the steps for general cracking:

1. Scan and recon
2. Hopefully find an exploit
3. Use metasploit (msfconsole)
   1. search for the exploit found
   2. set to use the exploit (with use NUMBER)
   3. set the host/port
   4. run (the exploit at the host)
4. Pray that you are successful
5. Escalate

Yet another Mr. Robot room 😅

In task 2 the name of the webserver starts with the word rejetto

*note the flag is in Desktop

Unless you have 30GB of space or don't want to waste 30GB, don't do this room!

If me want the badge (🥺👉👈), follow this tutorial: https://www.youtube.com/watch?v=JMyuEiz1dWQ

I turned myself into a CTF room Morty...

Follow the video but at this point, you should know your way around by now

Wireshark on the Attack machines can be opened with the wireshark command

In task 8, the last question requires it without the colon so use python to remove them

a = 'STRING HERE'
b = ''
for char in a:
    if char != ':':
	    b += char
print(b)

Programs should be installed by default on attack machines.

What do you do after you exploit the system? Well this room will let you find out how persistently stay on the system!

Kerberos must be installed in the Attack machines because dogs go waff waff hehe.

A nice intro to starting Django (Python web framework) development

For user flag, hint is look in /home after ssh

Thanks for taking time to look at these hints for TryHackMe. I hope this helped and by the end you would have reached Hacker rank and ~13,000 rank/500,000 users

🔝Back to Top