## https://sploitus.com/exploit?id=6B2E5EFD-7A46-547D-BE5C-DC785AC7421D
# TryHackMe Write-Ups
**Thirteen rooms, solved and then explained from scratch — every command, every wrong turn, every "why," in language a complete beginner can follow and a practitioner can still learn from.**
I keep this repository for two reasons. The first is selfish: if I can't explain a step in plain English, I didn't actually understand it, so writing these keeps me honest. The second is that almost every walkthrough I found when I started either skipped the step I was stuck on or assumed I already knew the thing I was trying to learn. These are the write-ups I wish I'd had.
Nothing here is a copy-paste of a room's official guide. Each one is my own session — including the commands that failed and what I did about them, because the debugging is usually where the real learning is.
---
## The rooms
Grouped by the main skill each one builds. If you're browsing to learn a specific topic, start with its section; if you just want the meatiest boxes, the ⭐ ones are the fullest chains.
### 🧠 AI & LLM Security
| Room | The core idea | Difficulty |
|------|---------------|:---:|
| ⭐ [The Guestbook](rooms/the-guestbook/README.md) | Talking an AI concierge into running server commands: prompt injection, fake keyword "authorization," and beating an output filter with Base64 | Medium |
### 🕸️ Web Exploitation
| Room | The core idea | Difficulty |
|------|---------------|:---:|
| ⭐ [Do Not Disturb](rooms/do-not-disturb/README.md) | NoSQL login bypass → template-injection RCE → an exposed Node debug port → reading the root flag off the raw disk | Medium |
| [The Hollow Shell](rooms/the-hollow-shell/README.md) | "Zip slip" — a malicious archive overwrites a template file and turns a file upload into a reverse shell | Medium |
| [Beach Bar](rooms/beach-bar/README.md) | Unsafe YAML parsing gives remote code execution; a password leaked in the process list finishes the job | Easy |
| [Ponzi Portfolio](rooms/ponzi-portfolio/README.md) | A race condition: firing 20 "claim" requests at once to beat a once-per-day check and unlock the vault | Medium |
### 🐧 Linux Privilege Escalation
| Room | The core idea | Difficulty |
|------|---------------|:---:|
| ⭐ [Dreaming](rooms/dreaming/README.md) | A four-account climb to root: `.phar` upload → leaked password → database command injection → hijacking a world-writable Python library | Medium |
| [Valley](rooms/valley/README.md) | Credentials hidden in JavaScript and captured network traffic, an unpacked binary, cracked hashes, and a cron job that trusts a file I can edit | Easy |
| [Guided Pentest: Infrastructure](rooms/guided-pentest-infrastructure/README.md) | A backdoored IRC service (CVE-2010-2075) and a plaintext root password — written up as a full pentest report | Easy |
### ☁️ Cloud Security
| Room | The core idea | Difficulty |
|------|---------------|:---:|
| [CryptoCabana](rooms/cryptocabana/README.md) | An over-permissioned Azure key in browser code leads to a Key Vault — and a "rotated" secret that's still readable in its history | Medium |
| [Byte Lotus Wellness](rooms/byte-lotus-wellness/README.md) | AWS Cognito hands guests too much power: a `Scan` permission lets any visitor dump the whole DynamoDB table | Medium |
### 🔎 Forensics, OSINT & Fundamentals
| Room | The core idea | Difficulty |
|------|---------------|:---:|
| [After Hours](rooms/after-hours/README.md) | Digital forensics: peeling malware out of a Windows database through layers of base64, UTF-16, and compression — without ever running it | Medium |
| [The Brochure](rooms/the-brochure/README.md) | Pure OSINT: following a brochure photo to a hidden Instagram account and a message hidden across its post grid | Easy |
| [Ninja Skills](rooms/ninja-skills/README.md) | Core Linux fluency — finding and inspecting scattered files, and solving one question from a *permission denial* alone | Easy |
> Many of these share a fictional universe — the **Byte Lotus Resort**, from TryHackMe's *Hacker Holidays* event. They're separate rooms, but the recurring theme is worth noticing: a friendly-looking feature (a guestbook, a booking form, a backup kiosk) is trusted to make a security decision it was never fit to make.
---
## How each write-up is built
Once you've read one, you know your way around all of them. Every room follows the same shape:
1. **The one-line version** up top — the whole attack in a sentence, before any detail.
2. **Skills & tools used** — tagged early, so you can tell what a room teaches before committing to it.
3. **How the target is built** — a plain description of the app/box, so the exploit later makes sense.
4. **A glossary** — every non-obvious term defined in plain words, in one place.
5. **The walkthrough** — numbered steps, each with the exact command *and* an explanation of what it does and why it matters right there.
6. **Attack chain + root cause** — a diagram of the full path, why it worked, and what a defender should have done instead.
Commands use ``-style placeholders because every TryHackMe session hands out a fresh, temporary address.
---
## What these rooms cover, as skills
`AI / LLM Agent Exploitation` · `Prompt Injection` · `NoSQL Injection` · `Insecure Deserialization (YAML)` · `Server-Side Template Injection` · `Zip Slip / Path Traversal` · `Race Conditions (TOCTOU)` · `Command Injection` · `Linux Privilege Escalation` · `Cron & Writable-File Abuse` · `Group-Privilege Abuse (disk group)` · `Cloud Misconfiguration (AWS Cognito / IAM, Azure SAS & Key Vault)` · `Reverse Engineering (UPX / ELF)` · `Hash Cracking` · `Network-Capture Analysis` · `Digital Forensics & Malware Deobfuscation` · `OSINT Pivoting` · `Pentest Reporting`
---
## A word on ethics & scope
Every room here was solved against a deliberately vulnerable, disposable machine inside TryHackMe's own lab environment — targets built and licensed for exactly this kind of practice. None of it targets any real system, and none of it should. The point is understanding *how* a class of weakness works so you can spot and defend against it; every write-up ends with the defender's side for that reason.
---
## About me
I'm **Akintomide Richard Fadeyi**. I'm working through TryHackMe as part of moving into a security career, and I publish these as I go. If a write-up here helped something finally click for you, that's the whole idea.
## Licence
Released under the [MIT Licence](LICENSE) — read it, share it, reuse it; attribution is appreciated.