Step 251. TryHackMe Intro Path + 3 Easy Rooms — Opening the Door to Real Machines

Level 3 — Real-World CTF & Advanced Offensive Skills | Difficulty ★★★☆☆ | Estimated time: 3 hours

Prerequisites: network fundamentals at the level of Step 80 (Scapy) and 83~84 (Wireshark), nmap scanning, basic Linux commands, and Step 125~126 (intro to privilege escalation).

What you need: an internet connection, a TryHackMe account (free signup), an attack machine (Kali or WSL+tools, or the THM web AttackBox).
⚠️ All exercises in this chapter are for your own lab and legal platforms only. Applying them to unauthorized systems is a crime. TryHackMe (tryhackme.com) is a legal learning platform officially opened by its operators for attack practice — do not use today’s techniques on anything other than this platform’s room machines.
Platform note: every THM screen and command output in this chapter is a screen example. The actual connection and solving is yours to do.

So far, your stage has been your own computer and pre-written problem sets. Starting today, you move to a real-world-style platform. TryHackMe (THM) is a real-machine platform where problems and guidance come together — each room spins up a virtual machine to attack, and you progress by submitting answers to the room’s questions.

If Bandit was "a ladder of commands," a THM Easy room is "one whole round of hacking" — reconnaissance, penetration, and privilege escalation, all finished inside a single machine. This is the start of the stretch where you internalize the order in which every technique you learned in Level 2 gets used against a real target.

1. Learning Objectives

By the end of this chapter, you will be able to:

Explain the structure of a TryHackMe room (tasks, questions, hints, machines)
Connect to the THM network with OpenVPN and confirm a machine’s IP
Apply the basic routine of recon → penetration → privilege escalation to Easy rooms
Use a room’s questions as a checklist to manage progress
Create a routine-recording template and leave write-ups for your first 3 rooms

2. Background Knowledge — Today’s Tools and Concepts

Today’s Tools at a Glance

Category	Details
Language/environment	TryHackMe web platform + attack machine (Kali/WSL) + OpenVPN
Today’s commands	`sudo openvpn file.ovpn`, `nmap -sV -p-`, `ping targetIP`
Concepts needed	Rooms and tasks, virtual machine rental, VPN tunnels, the machine-attack routine
Today’s deliverable	A VPN connection environment + 3 Easy rooms completed + routine-recording template v0

2-1. The Structure of a Room — Workbook Meets Practice Ground

A THM room is made up of units called tasks. Each task has explanations and questions, and you must submit the answers (flags or strings) to get progress checked off.

Room (e.g., RootMe)
 ├── Task 1: Deploy the machine and connect
 ├── Task 2: Recon — questions like "how many ports are open?"
 ├── Task 3: Penetration — "what are the contents of user.txt?"
 └── Task 4: Privilege escalation — "what are the contents of root.txt?"

One design point matters here: a room’s questions are effectively a checklist. The very existence of a question like "what is the hidden directory on the web server?" is a hint that "you need to find a hidden directory." When stuck, read the question list again — the questions are the path.

2-2. Machine Rental and VPN — Why the IP Won’t Reach

When you press a room’s "Start Machine" button, your own dedicated virtual machine comes up on THM’s internal network and receives an internal IP like 10.10.x.x (screen example):

Target IP: 10.10.10.10   (59 minutes until expiry)

This address lives on an internal network that doesn’t exist on the internet. For your attack machine to enter this network, you need a VPN tunnel. THM provides an OpenVPN configuration file; connecting with it makes your machine a node on THM’s internal network.

# connect with the config file downloaded from the THM site (screen example)
sudo openvpn myname.ovpn

...(snip)...
Initialization Sequence Completed

When this one line appears, the tunnel is open. Leave this terminal as-is while the connection stays up, and work in a new terminal. A single ping to the target machine is enough to confirm the connection.

ping -c 3 10.10.10.10     # (screen example) if replies come back, the connection is good

Machines usually shut down automatically after an hour, with an extend button if you need it. Using the AttackBox (a web-based attack machine you launch in the browser) works without a VPN, but it requires a paid subscription and responds slowly — in the long run, the your-machine + OpenVPN combination is recommended.

2-3. The Machine-Attack Routine — Level 2 Review, Deployed for Real

The order an Easy room demands is an arrangement of things you already know.

① Recon      nmap -sV -p- targetIP       → open ports and versions
② Investigate if web, path scan (gobuster etc.), service version search
③ Hypothesis "wouldn't there be a weakness in this version / this page?"
④ Penetration exploit or credentials → shell obtained
⑤ Enumeration information gathering inside the shell (Step 125~126)
⑥ Escalation  sudo -l, SUID, cron → root
⑦ Evidence    submit user.txt, root.txt

In Level 2 you learned each step separately; from now on, this arrangement rolls within a single round. Today’s real assignment isn’t cracking 3 rooms — it’s getting this order engraved into your fingers.

2-4. Recommended First Rooms

Three Easy rooms proven for the intro stretch. All three have friendly hints and are solvable with Level 2 techniques alone.

Room	Main practice	Connected prior chapters
RootMe	web file upload → shell → SUID privesc	web basics + Step 106/125
Simple CTF	FTP/web recon → vulnerable service → sudo privesc	recon + Step 125
Basic Pentesting	SMB/web enumeration → brute force → privesc	Step 124 + enumeration

For any room, the first approach order is the same — start machine → confirm IP → nmap → read the question list.

3. Follow Along

Today’s Section 3 covers environment setup and the flow of your first room. Since you connect to THM yourself, every screen is an example.

3-1. Signup and VPN Setup

Create a free account at tryhackme.com.
From the site’s Access menu, download your OpenVPN config file (username.ovpn).
Connect from your attack machine (Kali or Linux) (screen example):

sudo openvpn username.ovpn

...
Initialization Sequence Completed

Open a new terminal and check the tunnel interface (screen example):

ip addr show tun0

tun0: <POINTOPOINT,MULTICAST,NOARP,UP,LOWER_UP> ...
    inet 10.8.x.x ...

How to read the output: if a virtual interface named tun0 has picked up a 10.8.x.x address, you’re inside THM’s internal network. This address is your attack’s starting point.

3-2. Deploying Your First Machine and Confirming Connectivity

After getting comfortable with the environment in one guided room from an intro path (Pre Security or an Introduction series), open your first Easy room. Pressing "Start Machine" assigns an IP (screen example):

export TARGET=10.10.10.10   # saving the assigned IP in a variable is convenient
ping -c 3 $TARGET

64 bytes from 10.10.10.10: icmp_seq=1 ttl=63 time=45.2 ms

How to read the output: if replies come back, both the VPN and the machine are alive. If there’s no reply, it’s one of three things: ① the machine is still booting (wait 1~2 minutes), ② the VPN dropped, ③ an IP typo. See Wall 1 in Section 6.

3-3. Recon — The First Scene of Every Round

Input (screen example):

nmap -sV -p- $TARGET

Example output (a RootMe-family machine):

PORT   STATE SERVICE VERSION
22/tcp open  ssh     OpenSSH 7.6p1 Ubuntu 4ubuntu0.3
80/tcp open  http    Apache httpd 2.4.29 ((Ubuntu))

How to read the output: -p- looks at all 65,535 ports — services missed by the default scan (1,000 ports) are a habitual trap of real machines. -sV reads versions from banners. Here SSH (22) and web (80) are open, so investigation starts with the web — in Easy rooms, the penetration route is usually the web.

3-4. Questions as a Checklist — Managing Room Progress

Keep the room page’s question list open, and submit each answer as you find it. Tips for managing progress:

- Question order = the attack order the author intended, more or less
- "How many ports are open?" → the nmap you just ran knows the answer
- "What is the hidden directory?" → an instruction to run a path scan (gobuster)
- "user.txt?" → meaning: get a shell and look in home folders

A wrong answer doesn’t check off progress, so before submitting, jot down the basis (which command’s which output the answer came from). This habit becomes your write-up later.

3-5. The Routine-Recording Template — Your Command Order as a Document

A long-term asset that starts today. Create thm-routine.md, and each time you finish a room, organize the command order you actually typed.

# My machine-attack routine (v0 — started Step 251)
### Recon
- nmap -sV -p- $TARGET
- (if web found) gobuster dir -u http://$TARGET -w wordlist
### Investigation
- banner version → searchsploit / Google search
### Penetration
- (varies by room — record the weakness found)
### Privilege escalation
- sudo -l / find / -perm -4000 2>/dev/null / cat /etc/crontab
### Notes
- What I learned new in this room: ____

How to read the output: this document’s value comes from repetition. After 3 rooms, common patterns become visible, and those become the next chapter’s "common routine document." For now, a skeleton is enough.

4. Missions & Exercises

Mission — Building the VPN Environment and Completing 3 Easy Rooms

Create a TryHackMe account and connect to the internal network with OpenVPN
Learn machine deployment and answer submission in one guided room from an intro path
Complete the 3 recommended rooms from 2-4 (RootMe, Simple CTF, Basic Pentesting) or 3 comparable Easy rooms
For each room, record ① the nmap -sV -p- output ② a one-line summary of the penetration path ③ the technique used for privilege escalation
Fill the 3-5 routine template with the experience of 3 rooms to complete v0
Mark rooms where you used hints, and build a re-solve list to redo them later without hints

Exercises

Exercise 1. Explain what it means that a THM room’s questions are "effectively a checklist," in terms of the relationship between question order and attack order.

Exercise 2. Explain why your computer can’t directly reach a machine IP (10.10.x.x), and how OpenVPN solves this problem.

Exercise 3. What can happen if you omit -p- from nmap? Explain why it’s dangerous on real machines.

Exercise 4. The text said it’s okay to look at hints at first. What condition comes with that, and why is that condition necessary for learning?

5. Model Answers & Completion Criteria

Mission Model Answer

An example of the shape of a room record (fill the contents with your actual solve):

### RootMe (completed: ____)
- Recon: nmap -sV -p- → 22 (ssh), 80 (http) open (output notes/rootme-nmap.txt)
- Penetration path: web file upload restriction bypass → reverse shell
- Privesc: find / -perm -4000 → abnormal SUID binary → GTFOBins
- Learned: upload extension bypass, SUID hunting
- Hints used: 1 (privesc stage) — added to re-solve list

How to verify: ① Do 3 rooms show completion marks on your THM profile? ② Does each room record have its recon output saved as a file? ③ Is the privesc technique explained by commands, not "luck"? ④ Does the routine document organize the commands common to all 3 rooms? ⑤ Is hint usage marked honestly?

Exercise Answers

Answer 1. Room authors place questions in the order the attack progresses — recon-related questions come first, flag submissions come last. So just reading the question list gives you "the list of things to find in this room." Because what a question demands is an instruction for your next action, the first regression point when stuck is not a command but the question list.

Answer 2. 10.10.x.x is a private IP range that doesn’t get routed on the internet — an address valid only inside THM’s internal network. OpenVPN creates an encrypted tunnel (tun0) between your machine and THM’s internal network, making your machine participate like a node on that network. That’s why communication to 10.10.x.x becomes possible once the tunnel is up.

Answer 3. Without -p-, nmap looks at only the 1,000 common ports. If the author hid SSH on a non-standard port like 2222, the default scan misses it, and all subsequent analysis spins its wheels over a "nonexistent service." The most frequent cause of being stuck on real machines is "missing one open port" — a full scan isn’t optional; it’s the default.

Answer 4. The condition is "re-solve without hints." A room passed with hints gets a completion mark, but the skill didn’t transfer — that stretch still belongs to the hint. Only when you pass the same point on your own during the re-solve does it become yours. That’s why keeping a hint-usage record (how many times, at which stage) becomes the material for the re-solve list.

Completion Criteria Checklist

[ ] I created a TryHackMe account
[ ] I connected with OpenVPN and confirmed tun0 and a 10.8.x.x address
[ ] I deployed a machine and confirmed connectivity with ping
[ ] I made full scans with nmap -sV -p- a habit
[ ] I used the question list as a checklist
[ ] I completed 3 Easy rooms
[ ] I wrote routine-recording template v0
[ ] I marked hint-used rooms and built a re-solve list

6. Common Pitfalls & Fixes

Wall 1. Ping won’t reach the machine IP

Symptom (example output):

PING 10.10.10.10 (10.10.10.10) 56(84) bytes of data.
--- 10.10.10.10 ping statistics ---
3 packets transmitted, 0 received, 100% packet loss

Cause: ① the machine is booting, ② VPN not connected, ③ an IP typo, ④ machine time expired.
Fix: check in order — compare the IP on the room page against the one you typed → check VPN health with ip addr show tun0 → wait 1~2 minutes and retry → if it still fails, restart the machine. These four steps are 90% of THM troubleshooting.

Wall 2. sudo openvpn says the file doesn’t exist

Symptom (example output):

Options error: --ca fails with 'username.ovpn': No such file or directory

Cause: the folder you downloaded the config file to (like Windows’ Downloads) differs from the folder where you typed the command.
Fix: move the file to your working folder, or specify an absolute path. If you downloaded it on Windows, in WSL it’s at /mnt/c/Users/yourname/Downloads/username.ovpn.

Wall 3. The openvpn screen looks frozen

Symptom: after Initialization Sequence Completed, the prompt doesn’t come back.
Cause: it’s not broken — the VPN holding onto that terminal is normal behavior.
Fix: leave that terminal alone and work in a new one. To disconnect the VPN, press Ctrl+C in that terminal.

Wall 4. An hour in and you still can’t solve the first question

Symptom: you got as far as nmap but can’t think of what comes next.
Cause: you’re staring at the machine without reading the questions.
Fix: read the room’s questions in order from Task 1 — the very process of answering "how many ports are open?" is a recon guide. If you’re still stuck, look at the room’s official hints or a write-up — but per the Section 4 mission rule, put it on the re-solve list.

Wall 5. Machine time expired and the IP changed

Symptom: the IP you worked on yesterday doesn’t respond today.
Cause: machines shut down, and when restarted they get a new IP.
Fix: restart the machine and update $TARGET to the new IP. That’s why records should be kept path-centric ("upload bypass → shell") rather than IP-centric to be reusable — IPs are disposable; techniques are permanent assets.

7. Summary

Today’s Concepts

Concept	One-line explanation
Room	THM’s practice unit, made of tasks and questions
Task	A unit inside a room — explanation + questions + answer submission
AttackBox	THM’s web-based attack machine launched in the browser
OpenVPN tunnel	The passage connecting your machine to THM’s internal network (`tun0`)
Machine-attack routine	Recon → investigate → hypothesize → penetrate → enumerate → escalate → evidence
Routine document	An accumulation of my command orders — gains value with repetition

Today’s Commands & Tools

Command	What it does
`sudo openvpn file.ovpn`	Connect to THM’s internal network
`ip addr show tun0`	Check the VPN tunnel
`export TARGET=IP`	Save the target address in a variable
`nmap -sV -p- $TARGET`	Full-port + version scan (the recon default)
`ping -c 3 $TARGET`	Check whether the machine is alive

An Instinct More Important Than Commands

Real machines differ from problem sets — nobody tells you the scope of the answer, and that’s why reconnaissance is the problem set. The moment you skip the -p- full scan, that round is already tilted. And the habit of reading a room’s questions — before they’re a grading tool, questions are a map the author hands you. Finally, cherish the routine document you started today. Three rooms’ records are a memo, but as they pile up to 8, then 13, they become your very own attack manual. Skill grows not by the number of machines cracked, but by the thickness of the routine settled into your document.

Once every box is checked, Step 251 is complete. Click the checkbox in the sidebar to save your progress.