Step 251. TryHackMe Intro Path + 3 Easy Rooms — Opening the Door to Real Machines

Level 3 — Real-World CTF & Advanced Offensive Skills | Difficulty ★★★☆☆ | Estimated time: 3 hours

Prerequisites: network fundamentals at the level of Step 80 (Scapy) and 83~84 (Wireshark), nmap scanning, basic Linux commands, and Step 125~126 (intro to privilege escalation).

• What you need: an internet connection, a TryHackMe account (free signup), an attack machine (Kali or WSL+tools, or the THM web AttackBox).
• ⚠️ All exercises in this chapter are for your own lab and legal platforms only. Applying them to unauthorized systems is a crime. TryHackMe (tryhackme.com) is a legal learning platform officially opened by its operators for attack practice — do not use today’s techniques on anything other than this platform’s room machines.
• Platform note: every THM screen and command output in this chapter is a screen example. The actual connection and solving is yours to do.

So far, your stage has been your own computer and pre-written problem sets. Starting today, you move to a real-world-style platform. TryHackMe (THM) is a real-machine platform where problems and guidance come together — each room spins up a virtual machine to attack, and you progress by submitting answers to the room’s questions.

If Bandit was "a ladder of commands," a THM Easy room is "one whole round of hacking" — reconnaissance, penetration, and privilege escalation, all finished inside a single machine. This is the start of the stretch where you internalize the order in which every technique you learned in Level 2 gets used against a real target.

1. Learning Objectives

By the end of this chapter, you will be able to:

• Explain the structure of a TryHackMe room (tasks, questions, hints, machines)
• Connect to the THM network with OpenVPN and confirm a machine’s IP
• Apply the basic routine of recon → penetration → privilege escalation to Easy rooms
• Use a room’s questions as a checklist to manage progress
• Create a routine-recording template and leave write-ups for your first 3 rooms

2. Background Knowledge — Today’s Tools and Concepts

Today’s Tools at a Glance

2-1. The Structure of a Room — Workbook Meets Practice Ground

A THM room is made up of units called tasks. Each task has explanations and questions, and you must submit the answers (flags or strings) to get progress checked off.

Room (e.g., RootMe)
 ├── Task 1: Deploy the machine and connect
 ├── Task 2: Recon — questions like "how many ports are open?"
 ├── Task 3: Penetration — "what are the contents of user.txt?"
 └── Task 4: Privilege escalation — "what are the contents of root.txt?"

One design point matters here: a room’s questions are effectively a checklist. The very existence of a question like "what is the hidden directory on the web server?" is a hint that "you need to find a hidden directory." When stuck, read the question list again — the questions are the path.

2-2. Machine Rental and VPN — Why the IP Won’t Reach

When you press a room’s "Start Machine" button, your own dedicated virtual machine comes up on THM’s internal network and receives an internal IP like 10.10.x.x (screen example):

Target IP: 10.10.10.10   (59 minutes until expiry)

This address lives on an internal network that doesn’t exist on the internet. For your attack machine to enter this network, you need a VPN tunnel. THM provides an OpenVPN configuration file; connecting with it makes your machine a node on THM’s internal network.

# connect with the config file downloaded from the THM site (screen example)
sudo openvpn myname.ovpn

...(snip)...
Initialization Sequence Completed

When this one line appears, the tunnel is open. Leave this terminal as-is while the connection stays up, and work in a new terminal. A single ping to the target machine is enough to confirm the connection.

ping -c 3 10.10.10.10     # (screen example) if replies come back, the connection is good

Machines usually shut down automatically after an hour, with an extend button if you need it. Using the AttackBox (a web-based attack machine you launch in the browser) works without a VPN, but it requires a paid subscription and responds slowly — in the long run, the your-machine + OpenVPN combination is recommended.

2-3. The Machine-Attack Routine — Level 2 Review, Deployed for Real

The order an Easy room demands is an arrangement of things you already know.

① Recon      nmap -sV -p- targetIP       → open ports and versions
② Investigate if web, path scan (gobuster etc.), service version search
③ Hypothesis "wouldn't there be a weakness in this version / this page?"
④ Penetration exploit or credentials → shell obtained
⑤ Enumeration information gathering inside the shell (Step 125~126)
⑥ Escalation  sudo -l, SUID, cron → root
⑦ Evidence    submit user.txt, root.txt

In Level 2 you learned each step separately; from now on, this arrangement rolls within a single round. Today’s real assignment isn’t cracking 3 rooms — it’s getting this order engraved into your fingers.

2-4. Recommended First Rooms

Three Easy rooms proven for the intro stretch. All three have friendly hints and are solvable with Level 2 techniques alone.

For any room, the first approach order is the same — start machine → confirm IP → nmap → read the question list.

3. Follow Along

Today’s Section 3 covers environment setup and the flow of your first room. Since you connect to THM yourself, every screen is an example.

3-1. Signup and VPN Setup

1. Create a free account at tryhackme.com.
2. From the site’s Access menu, download your OpenVPN config file (username.ovpn).
3. Connect from your attack machine (Kali or Linux) (screen example):

sudo openvpn username.ovpn

...
Initialization Sequence Completed

4. Open a new terminal and check the tunnel interface (screen example):

ip addr show tun0

tun0: <POINTOPOINT,MULTICAST,NOARP,UP,LOWER_UP> ...
    inet 10.8.x.x ...

How to read the output: if a virtual interface named tun0 has picked up a 10.8.x.x address, you’re inside THM’s internal network. This address is your attack’s starting point.

3-2. Deploying Your First Machine and Confirming Connectivity

After getting comfortable with the environment in one guided room from an intro path (Pre Security or an Introduction series), open your first Easy room. Pressing "Start Machine" assigns an IP (screen example):

export TARGET=10.10.10.10   # saving the assigned IP in a variable is convenient
ping -c 3 $TARGET

64 bytes from 10.10.10.10: icmp_seq=1 ttl=63 time=45.2 ms

How to read the output: if replies come back, both the VPN and the machine are alive. If there’s no reply, it’s one of three things: ① the machine is still booting (wait 1~2 minutes), ② the VPN dropped, ③ an IP typo. See Wall 1 in Section 6.

3-3. Recon — The First Scene of Every Round

Input (screen example):

nmap -sV -p- $TARGET

Example output (a RootMe-family machine):

PORT   STATE SERVICE VERSION
22/tcp open  ssh     OpenSSH 7.6p1 Ubuntu 4ubuntu0.3
80/tcp open  http    Apache httpd 2.4.29 ((Ubuntu))

How to read the output: -p- looks at all 65,535 ports — services missed by the default scan (1,000 ports) are a habitual trap of real machines. -sV reads versions from banners. Here SSH (22) and web (80) are open, so investigation starts with the web — in Easy rooms, the penetration route is usually the web.

3-4. Questions as a Checklist — Managing Room Progress

Keep the room page’s question list open, and submit each answer as you find it. Tips for managing progress:

- Question order = the attack order the author intended, more or less
- "How many ports are open?" → the nmap you just ran knows the answer
- "What is the hidden directory?" → an instruction to run a path scan (gobuster)
- "user.txt?" → meaning: get a shell and look in home folders

A wrong answer doesn’t check off progress, so before submitting, jot down the basis (which command’s which output the answer came from). This habit becomes your write-up later.

3-5. The Routine-Recording Template — Your Command Order as a Document

A long-term asset that starts today. Create thm-routine.md, and each time you finish a room, organize the command order you actually typed.

# My machine-attack routine (v0 — started Step 251)
### Recon
- nmap -sV -p- $TARGET
- (if web found) gobuster dir -u http://$TARGET -w wordlist
### Investigation
- banner version → searchsploit / Google search
### Penetration
- (varies by room — record the weakness found)
### Privilege escalation
- sudo -l / find / -perm -4000 2>/dev/null / cat /etc/crontab
### Notes
- What I learned new in this room: ____

How to read the output: this document’s value comes from repetition. After 3 rooms, common patterns become visible, and those become the next chapter’s "common routine document." For now, a skeleton is enough.

4. Missions & Exercises

Mission — Building the VPN Environment and Completing 3 Easy Rooms

1. Create a TryHackMe account and connect to the internal network with OpenVPN
2. Learn machine deployment and answer submission in one guided room from an intro path
3. Complete the 3 recommended rooms from 2-4 (RootMe, Simple CTF, Basic Pentesting) or 3 comparable Easy rooms
4. For each room, record ① the nmap -sV -p- output ② a one-line summary of the penetration path ③ the technique used for privilege escalation
5. Fill the 3-5 routine template with the experience of 3 rooms to complete v0
6. Mark rooms where you used hints, and build a re-solve list to redo them later without hints

Exercises

Exercise 1. Explain what it means that a THM room’s questions are "effectively a checklist," in terms of the relationship between question order and attack order.

Exercise 2. Explain why your computer can’t directly reach a machine IP (10.10.x.x), and how OpenVPN solves this problem.

Exercise 3. What can happen if you omit -p- from nmap? Explain why it’s dangerous on real machines.

Exercise 4. The text said it’s okay to look at hints at first. What condition comes with that, and why is that condition necessary for learning?

### RootMe (completed: ____)
- Recon: nmap -sV -p- → 22 (ssh), 80 (http) open (output notes/rootme-nmap.txt)
- Penetration path: web file upload restriction bypass → reverse shell
- Privesc: find / -perm -4000 → abnormal SUID binary → GTFOBins
- Learned: upload extension bypass, SUID hunting
- Hints used: 1 (privesc stage) — added to re-solve list

6. Common Pitfalls & Fixes

Wall 1. Ping won’t reach the machine IP

Symptom (example output):

PING 10.10.10.10 (10.10.10.10) 56(84) bytes of data.
--- 10.10.10.10 ping statistics ---
3 packets transmitted, 0 received, 100% packet loss

Cause: ① the machine is booting, ② VPN not connected, ③ an IP typo, ④ machine time expired.
Fix: check in order — compare the IP on the room page against the one you typed → check VPN health with ip addr show tun0 → wait 1~2 minutes and retry → if it still fails, restart the machine. These four steps are 90% of THM troubleshooting.

Wall 2. sudo openvpn says the file doesn’t exist

Symptom (example output):

Options error: --ca fails with 'username.ovpn': No such file or directory

Cause: the folder you downloaded the config file to (like Windows’ Downloads) differs from the folder where you typed the command.
Fix: move the file to your working folder, or specify an absolute path. If you downloaded it on Windows, in WSL it’s at /mnt/c/Users/yourname/Downloads/username.ovpn.

Wall 3. The openvpn screen looks frozen

Symptom: after Initialization Sequence Completed, the prompt doesn’t come back.
Cause: it’s not broken — the VPN holding onto that terminal is normal behavior.
Fix: leave that terminal alone and work in a new one. To disconnect the VPN, press Ctrl+C in that terminal.

Wall 4. An hour in and you still can’t solve the first question

Symptom: you got as far as nmap but can’t think of what comes next.
Cause: you’re staring at the machine without reading the questions.
Fix: read the room’s questions in order from Task 1 — the very process of answering "how many ports are open?" is a recon guide. If you’re still stuck, look at the room’s official hints or a write-up — but per the Section 4 mission rule, put it on the re-solve list.

Wall 5. Machine time expired and the IP changed

Symptom: the IP you worked on yesterday doesn’t respond today.
Cause: machines shut down, and when restarted they get a new IP.
Fix: restart the machine and update $TARGET to the new IP. That’s why records should be kept path-centric ("upload bypass → shell") rather than IP-centric to be reusable — IPs are disposable; techniques are permanent assets.

7. Summary

Today’s Concepts

Today’s Commands & Tools

An Instinct More Important Than Commands

Real machines differ from problem sets — nobody tells you the scope of the answer, and that’s why reconnaissance is the problem set. The moment you skip the -p- full scan, that round is already tilted. And the habit of reading a room’s questions — before they’re a grading tool, questions are a map the author hands you. Finally, cherish the routine document you started today. Three rooms’ records are a memo, but as they pile up to 8, then 13, they become your very own attack manual. Skill grows not by the number of machines cracked, but by the thickness of the routine settled into your document.

Once every box is checked, Step 251 is complete.