TryHackMe room writeups. Each writeup covers the full approach — recon, exploitation, and post-exploitation — with screenshots at every step.
| Room | Difficulty | Topics | Writeup |
|---|---|---|---|
| Pickle Rick | Easy | Web enumeration, command injection, privilege escalation | Read |
| Corridor | Easy | IDOR, URL pattern analysis, web enumeration | Read |
| Neighbour | Easy | IDOR, source code review | Read |
| TakeOver | Easy | Subdomain enumeration, subdomain takeover, DNS | Read |
| HeartBleed | Easy | CVE exploitation, OpenSSL, network security | Read |
| The Game | Easy | Static analysis, reverse engineering, Ghidra | Read |
| Compiled | Easy | Binary analysis, decompilation, Ghidra | Read |
| Smol | Medium | WordPress exploitation, plugin backdoor, password cracking | Read |
| Bricks Heist | Medium | WordPress forensics, malware analysis, crypto wallet tracing | Read |
| Mr. Robot | Medium | WordPress brute force, RCE via theme editor, SUID privesc | Read |
Every writeup follows the same flow:
Start with connectivity check (ping) and a service scan (nmap -sV). Identify open ports and running services before touching anything else.
Go deeper based on what recon found. For web: check source, inspect JS, fuzz directories. For binaries: run file, check strings, import into Ghidra. For domains: enumerate subdomains with ffuf or gobuster.
Use the information gathered to get initial access or extract the flag. Follow the path of least resistance — credentials in source, IDOR via parameter manipulation, known CVE against a fingerprinted service version.
Where the room requires deeper access: check SUID binaries (find / -perm -4000), inspect running services, look for world-readable sensitive files. Escalate privileges only as far as needed to complete the objective.
Document every command and screenshot. Write the explanation as if explaining to someone learning — not just a flag dump.
All writeups are done on my own machine (Kali Linux) connected to the TryHackMe VPN. No AttackBox.
sudo openvpn your-tryhackme.ovpn