Step 252. THM Easy ×5 (8 Cumulative) — Engraving the Routine into Your Fingers

Level 3 — Real-World CTF & Advanced Offensive Skills | Difficulty ★★★☆☆ | Estimated time: 5 hours

Prerequisites: Step 251 (TryHackMe intro — VPN environment, 3 Easy rooms, routine template v0).

What you need: Step 251’s VPN environment and routine-recording document, a timer (a stopwatch app is enough), a folder for room records.
⚠️ All exercises in this chapter are for your own lab and legal platforms only. Applying them to unauthorized systems is a crime. TryHackMe is a legal learning platform — do not use today’s techniques on anything other than this platform’s room machines.
Platform note: every THM screen and output in this chapter is a screen example. The actual solving is yours to do.

Attacking machines is a routine game. nmap → service investigation → path scan if web → vulnerability hypothesis → exploit → shell → enumeration → privilege escalation. Until this order is engraved into your fingers, it’s not skill but luck shaking the board.

Today you add 5 Easy rooms to reach 8 cumulative. But the completion criterion isn’t the count — it’s measuring per-stage elapsed time, documenting regression points for when you get stuck, and extracting a common routine from 8 rooms’ records. After 8 machines, you’ll finally be able to self-diagnose "at which stage did I get stuck."

1. Learning Objectives

By the end of this chapter, you will be able to:

Apply the same routine to machines of different types (web-centric, SMB-centric, etc.)
Measure per-stage elapsed time to find your weak stage
Document regression points for when you’re stuck (re-scan → re-search → re-enumerate)
Fix the habit of never skipping recon with the -p- full scan
Write common routine document v1 from 8 cumulative rooms’ records

2. Background Knowledge — Today’s Tools and Concepts

Today’s Tools at a Glance

Category	Details
Language/environment	Step 251’s THM environment as-is (OpenVPN + attack machine)
Today’s commands	`nmap -sV -p-`, `gobuster dir`, `enum4linux`, `searchsploit` — all review
Concepts needed	Routine settling, per-stage time measurement, regression points, per-type approaches
Today’s deliverable	5 room records + a per-stage time table + common routine document v1

2-1. Why Repetition — How a Routine Settles In

For the first 3 rooms, you followed the routine "while thinking." Today’s goal is the state where your hands move first "without thinking." This transition happens only through deliberate repetition — starting every round in the same order, recording every round, comparing at the end of every round.

The signal of settling appears like this: the moment you receive a machine IP, your hands type nmap -sV -p-; while the scan runs, you read the question list; when results come out, you classify the type. As much as the consciousness you spent on judging disappears, that consciousness remains available for the truly hard problem (the penetration hypothesis).

2-2. Per-Type Approaches — The First Scan Decides the Path

Easy rooms split into types by the first nmap result. Organize the first action per type in a table.

Type	What the scan shows	First action
Web-centric	80/443 open	path scan (`gobuster`) + read page source
File sharing	139/445 (SMB) open	share list with `enum4linux` or `smbclient`
FTP exposed	21 open (possible anonymous login)	try anonymous access → file list
Non-standard ports	services on 3000, 8080, etc.	check banner/version → `searchsploit`
SSH only	only 22 open	credential clues must be found elsewhere — suspect a re-scan

The key point is "the types differ, but the routine stays the same" — recon results only decide the branch; no type lets you skip recon.

2-3. Per-Stage Time Measurement — Self-Diagnosing Weaknesses

Turn on a timer and write down the time each time the stage changes.

Machine: (name)      start: 14:00
recon complete: 14:07   (7 min)
penetration (shell): 14:41    (34 min)  ← the longest stretch
privilege escalation: 15:02   (21 min)

Time is an X-ray of skill. If recon takes 30 minutes, your tool handling is unskilled; if penetration takes an hour, your hypothesis-building is weak; if you stall at escalation, it’s an enumeration-habit problem. You need to know where you spend time for your next training to be decided — Step 173’s time analysis applies to machine attacks exactly as-is.

2-4. Stuck-Regression Points — Decide Where to Return in Advance

When stuck, blindly trying new things is firing wild. Going back in a fixed order is regression.

① Re-check the scan   — run nmap -p- again. Any missed ports?
② Re-search versions  — re-read banner versions precisely, run searchsploit
③ Re-scan paths       — re-run gobuster with a bigger wordlist
④ Re-run enumeration  — if inside a shell, run linPEAS again, re-check read-only items
⑤ Re-read questions   — "things not yet answered" in the room's question list are hints

The two most frequent causes of being stuck in Easy rooms are "missing one open port" and "an insufficient path-scan wordlist." For both, the prescription is going back and doing it wider, again.

3. Follow Along

3-1. Picking Today’s Rooms — Diversify the Types

The criterion for choosing 5 rooms isn’t difficulty but spread of types. You must pick different rows from the 2-2 table so every branch of the routine gets trained.

Selection example (for type coverage):
□ 1 web-centric — path scanning and upload/injection practice
□ 1 SMB-centric — enum4linux, share enumeration practice
□ 1 FTP-exposed — anonymous access and credential discovery practice
□ 1 non-standard port — banner analysis and exploit search practice
□ 1 free choice — pick the type you've been weakest at so far

How to read the output: the tags in a room’s description (web, smb, ctf) and your first nmap result are the materials for type classification. The "free choice" slot is your weakness-review slot — if there’s a type you used hints on in Step 251, that’s the type.

3-2. The Time-Measurement Routine — Same Template Every Round

For each room, open a record file and start (screen example):

mkdir -p thm-log/room04
date '+start: %H:%M' | tee thm-log/room04/timeline.txt

Each time the stage changes, append to the same file — like date '+recon done: %H:%M' | tee -a .... Save recon output in the same folder too.

nmap -sV -p- $TARGET | tee thm-log/room04/nmap-full.txt

How to read the output: tee shows you the screen while simultaneously leaving a file. Step 250’s work-journal habit continues into machine attacks. A round without records is a round you can’t review.

3-3. Fixing Recon in Place — Never Skip the Full Scan

For any room, the first 10 minutes’ order is fixed (screen example):

nmap -sV -p- $TARGET          # 1) full ports + versions
gobuster dir -u http://$TARGET -w /usr/share/wordlists/dirb/common.txt   # 2) path scan if web

There’s something to do while the scan runs — read the room’s question list and write the things you’ll need to answer into the record file. The habit of spending waiting time as part of recon.

How to read the output: step 2 applies only when a web port shows in the first scan. If SMB shows, enum4linux $TARGET goes into slot 2 — the type branch happens here.

3-4. Real Stuck Moments — Practicing Regression Points

When stuck, don’t stop the timer — record the regression step and the time.

14:41 stuck at penetration stage — regression ① scan re-check: no change
14:48 regression ③ path re-scan: found /panel with a bigger list
14:52 penetration resumes

How to read the output: as these records accumulate, you’ll see "at which regression step do I usually break through." If you break through at ① often, your first scan is hasty; if at ③ often, your wordlist selection is weak. The record of being stuck is itself your training prescription.

3-5. Wrapping Up — Common Routine Document v1

Once you reach 8 cumulative, spread the 8 rooms’ records out and extract only the commands that appeared in every round.

# My machine-attack routine v1 (based on 8 cumulative)
### Recon (done in every round)
- nmap -sV -p- $TARGET
- read the question list while the scan runs
### Branching (by type)
- Web: gobuster dir ... common.txt → (bigger list if insufficient)
- SMB: enum4linux $TARGET
- FTP: ftp $TARGET (try anonymous)
### Privesc (done in every round after shell)
- sudo -l → find / -perm -4000 2>/dev/null → cat /etc/crontab
### My weakness (time measurement results)
- Longest stage: ____ / countermeasure: ____

How to read the output: v1’s value lies in containing only "what I actually did." It’s a document built from 8 rounds of evidence, not someone else’s blog routine. This document keeps growing through the next chapter (privesc deep dive) and the Medium rooms beyond.

4. Missions & Exercises

Mission — 5 More Easy Rooms and Common Routine v1

Select 5 Easy rooms of different types per the 3-1 criteria
For each room, leave a timeline file (start, recon, penetration, escalation times) and recon output
Never skip the recon stage — the -p- full scan is the first command of every round
Each time you’re stuck, apply the 2-4 regression points and record at which step you broke through
After completing 8 cumulative, compute per-stage average times and write a common routine document v1 in the 3-5 format

Exercises

Exercise 1. Explain what "attacking machines is a routine game" means, together with why the routine holds even when types differ.

Exercise 2. Explain why you measure per-stage elapsed time, using what "recon 30 minutes" and "penetration 60 minutes" each suggest as examples.

Exercise 3. Explain why, when stuck, you should do "regression" first rather than "new attempts."

Exercise 4. Explain why ① scan re-check and ③ path re-scan come first among the 2-4 regression points, connecting them to the most frequent causes of being stuck in Easy rooms.

5. Model Answers & Completion Criteria

Mission Model Answer

An example of one room’s record shape (contents are your actual solve):

### Room 04 — (name) / type: SMB-centric
- Time: recon 6 min / penetration 22 min / escalation 14 min (42 min total)
- Recon: 22, 139, 445 open → user list obtained via enum4linux
- Penetration: credential hint in a share → SSH access
- Escalation: sudo -l shows (ALL) NOPASSWD: /bin/somecommand → GTFOBins
- Stuck: once — broke through with regression ② version re-search
- Newly learned: viewing share lists with smbclient -L //IP/

An example cumulative time table:

| rooms | recon | penetration | escalation | total |
|----|------|------|------|------|
| 01~03 avg | 12 min | 45 min | 30 min | 87 min |
| 04~08 avg | 7 min  | 28 min | 19 min | 54 min |

How to verify: ① THM profile shows 8 cumulative completions. ② Does each room have a timeline and recon output file? ③ Did the second-half averages shrink compared to the first half — if so, the routine is settling in (it’s fine if they didn’t shrink; in that case, record that a weak stage was diagnosed). ④ Does common routine v1 distinguish "things done in every round" from "per-type branches"? ⑤ Is the "my weakness" cell filled in?

Exercise Answers

Answer 1. Each machine’s vulnerability differs, but the procedure for finding it is the same — recon reveals the surface, the surface decides the type, the type decides the branch. Once the routine is engraved in your hands, the judgment cost of "what to do next" disappears, and consciousness focuses on the truly hard part (the penetration hypothesis). It’s like joseki in Go — the patterns play out differently each game, but the body knows the order of moves.

Answer 2. Time tells you where the weakness is. Spending 30 minutes on recon means tool manipulation itself is unskilled, so command practice is the prescription; spending 60 minutes on penetration means hypothesis-building and searching ability are the problem, so that’s the training prescription. Review without measurement leaves only "I worked hard"; review with measurement leaves "what to do next."

Answer 3. Most stuck moments arise not from "not knowing" but from "missing" — cases where the answer is already inside collected information but was passed over. A new attempt adds information, but regression re-reads the information you already have. Especially in Easy rooms, which are designed so all needed information sits within the first recon radius, going back is faster than going forward.

Answer 4. Because the most frequent causes of being stuck in Easy rooms are "missing one open port" (skipping the full scan) and "an insufficient path-scan list." Both are holes in the information-collection stage, not errors in the judgment stage. So the regression order re-checks collection (scan, paths) first, then re-examines judgment (version search, hypotheses) — changing the recipe while ingredients are missing accomplishes nothing.

Completion Criteria Checklist

[ ] I selected 5 Easy rooms of different types (web, SMB, FTP, non-standard, free)
[ ] I confirmed 8 cumulative completion marks
[ ] I started every round with a -p- full scan
[ ] I recorded per-stage times for each room
[ ] I recorded the regression step and breakthrough point for each stuck moment
[ ] I built a per-stage average time table
[ ] I wrote common routine document v1
[ ] I wrote "my weak stage" and a countermeasure in the document

6. Common Pitfalls & Fixes

Wall 1. The -p- scan takes too long

Symptom: the full scan takes several minutes and feels frustrating.
Cause: that’s normal — opening 65,535 ports takes a few minutes. VPN-latency adds to it too.
Fix: spend the waiting time as part of recon — read the question list, prepare the record file. If you’re in a hurry, you can parallelize: start web investigation with a quick default scan (nmap -sV $TARGET) first, while the full scan runs in a background terminal. But don’t conclude "it’s not there" before checking the full scan’s results.

Wall 2. gobuster finds nothing

Symptom (example output):

===============================================================
Finished
===============================================================

Cause: the wordlist is small, the extension option is missing, or the target isn’t web.
Fix: ① try attaching extensions (-x php,txt,html) — pages often exist but don’t get hit without extensions. ② Switch to a bigger list (the directory-list-2.3-medium.txt family). ③ If the first scan showed no web port, re-check non-standard ports like 8080.

Wall 3. You get stuck at the same place in every room

Symptom: for example, 5 out of 8 rooms stalled at privilege escalation.
Cause: that stage’s techniques are weak — not a routine problem but a training shortage in a specific stage.
Fix: that’s the harvest of time measurement. The next chapter is exactly the Linux privesc intensive stretch — collect the "techniques used for escalation" from the machines where you got stuck. Combined with the next chapter’s pattern notes, the weakness turns into a training list.

Wall 4. Records keep slipping

Symptom: the round ended and timeline.txt has only the start time.
Cause: when you’re immersed, recording slips — normal, but left alone your review material vanishes.
Fix: make recording part of the stage transition — bundle "got a shell = write one line in timeline.txt" into a single motion. Keeping a recording terminal open beside the shell prompt is the most reliable prescription.

Wall 5. You follow someone else’s write-up keystroke for keystroke and call it done

Symptom: the completion mark got checked, but a week later you can’t solve the same room alone.
Cause: you confused completion with learning.
Fix: if you copied, mark [write-up referenced] in your records and put it on the re-solve list (Step 251’s rule). Time measurement must be done in the re-solve round to capture real skill. Remember this stretch’s goal is not the completion count but the routine’s settling.

7. Summary

Today’s Concepts

Concept	One-line explanation
Routine settling	Repetition of the same order erases judgment cost
Type branching	The first scan’s results decide the investigation direction
Time measurement	Per-stage elapsed time = a map of weakness locations
Regression points	When stuck, go back in a fixed order (re-scan first)
Common routine document	My manual, distilled to commands that appeared in every round

Today’s Commands & Tools

Command	What it does
`nmap -sV -p- $TARGET`	The first command of every round — full ports + versions
`gobuster dir -u URL -w list -x php,txt,html`	Web path scan (with extensions)
`enum4linux $TARGET`	SMB enumeration (users, share list)
`searchsploit service version`	Search public exploits by banner version
`date '+%H:%M' \| tee -a timeline.txt`	Record stage-transition times

An Instinct More Important Than Commands

What 8 rounds teach is not 8 vulnerabilities but one routine. The moment you skip recon, that round tilts; the person who decided in advance where to return when stuck breaks through faster. And trust the time table — unmeasured, a weakness is a feeling; measured, it’s a location. The routine document v1 you completed today is still thin. But as it thickens through the coming stretches (privesc deep dive, Medium machines), this document is the skeleton that will keep you unshaken someday in front of "a machine you’ve never seen."

Once every box is checked, Step 252 is complete. Click the checkbox in the sidebar to save your progress.