// Packet Bandit Lab — TryHackMe Writeups Screen (Enhanced) const WRITEUPS = [ { id: 'mrrobot', title: 'Mr Robot', category: 'Privilege Escalation', badgeColor: 'purple', theme: { c1: '#ef4444', c2: '#22c55e', label: 'fsociety' }, difficulty: 2, cats: ['web','privesc'], desc: 'Chain robots.txt disclosure, WordPress username enumeration, Hydra brute forcing, theme editor RCE, MD5 cracking, and SUID nmap 3.81 to recover all three keys.', tags: ['robots.txt','WordPress','hydra','MD5','SUID nmap'], file: 'mrrobot.html', }, { id: 'wonderland', title: 'Wonderland', category: 'Privilege Escalation', badgeColor: 'purple', theme: { c1: '#ec4899', c2: '#8b5cf6', label: 'rabbit-hole' }, difficulty: 2, cats: ['web','privesc'], desc: 'Follow the white rabbit into hidden SSH credentials, then chain Python library hijacking, PATH hijacking, and Perl cap_setuid capabilities to reach root.', tags: ['nmap','curl','SSH','Python hijack','capabilities'], file: 'wonderland.md', }, { id: 'tomghost', title: 'Tomghost', category: 'Privilege Escalation', badgeColor: 'purple', theme: { c1: '#22d3ee', c2: '#f97316', label: 'ghostcat' }, difficulty: 1, cats: ['web','privesc'], desc: 'Exploit exposed AJP on Tomcat 9.0.30 to read WEB-INF/web.xml, pivot through leaked SSH credentials, then turn sudo zip into a root command execution primitive.', tags: ['AJP','Tomcat','Ghostcat','SSH','sudo zip'], file: 'tomghost.md', }, { id: 'takeover', title: 'TakeOver', category: 'Subdomain Takeover', badgeColor: 'orange', theme: { c1: '#f97316', c2: '#fbbf24', label: 'recon' }, difficulty: 1, cats: ['subdomain-takeover','web'], desc: 'Discover a forgotten support subdomain via TLS certificate SAN inspection, identify a dangling AWS S3 endpoint, and validate a subdomain takeover condition.', tags: ['ffuf','openssl','AWS S3','recon'], file: 'takeover.md', }, { id: 'compiled', title: 'Compiled', category: 'Reverse Engineering', badgeColor: 'orange', theme: { c1: '#f59e0b', c2: '#10b981', label: 'binary' }, difficulty: 1, cats: ['reverse-engineering'], desc: 'Recover the correct password from an ELF binary using static analysis — tracing scanf format strings, strcmp control flow, and .rodata resolution without ever running the binary.', tags: ['objdump','strings','nm','ELF','x86-64'], file: 'compiled.md', }, { id: 'wgel', title: 'Wgel', category: 'Privilege Escalation', badgeColor: 'purple', theme: { c1: '#a855f7', c2: '#38bdf8', label: 'exfil' }, difficulty: 1, cats: ['web','privesc'], desc: 'Enumerate a deceptive default web page to uncover an exposed SSH private key, then abuse a privileged wget binary to exfiltrate root-owned files via HTTP POST body injection.', tags: ['nmap','gobuster','SSH keys','sudo','wget'], file: 'wgel.md', }, { id: 'epoch', title: 'Epoch', category: 'Web', badgeColor: 'blue', theme: { c1: '#38bdf8', c2: '#818cf8', label: 'unix-time' }, difficulty: 1, cats: ['web'], desc: 'Exploit an unsanitized epoch-to-UTC converter to achieve OS command injection via bash -c, read server-side Go source to confirm the vulnerability, and extract the flag.', tags: ['curl','command injection','bash','Go'], file: 'epoch.md', }, { id: 'nmap', title: 'Intermediate Nmap', category: 'Network', badgeColor: 'green', theme: { c1: '#4ade80', c2: '#38bdf8', label: 'scan' }, difficulty: 2, cats: ['network'], desc: 'Perform full-port scanning with service detection to discover credentials leaked on a non-standard high port, pivot into SSH access, and locate a world-readable flag.', tags: ['nmap','ssh','sshpass','banner analysis'], file: 'nmap.md', }, { id: 'passcode', title: 'PassCode', category: 'Web3', badgeColor: 'web3', theme: { c1: '#a78bfa', c2: '#22d3ee', label: 'evm' }, difficulty: 1, cats: ['web3'], desc: "Read a deployed smart contract's supposedly private storage slots directly via eth_getStorageAt JSON-RPC — no wallet, no transaction — and recover the flag.", tags: ['curl','JSON-RPC','Solidity','EVM storage'], file: 'passcode.md', }, { id: 'neighbour', title: 'Neighbour', category: 'Web', badgeColor: 'blue', theme: { c1: '#38bdf8', c2: '#f472b6', label: 'idor' }, difficulty: 1, cats: ['web'], desc: 'Use guest credentials leaked in source, trace the post-login redirect to profile.php?user=guest, then exploit an IDOR by swapping the user reference to admin.', tags: ['curl','IDOR','PHP sessions','broken access control'], file: 'neighbour.md', }, { id: 'anonymous', title: 'Anonymous', category: 'Privilege Escalation', badgeColor: 'purple', theme: { c1: '#00ff5a', c2: '#dc2626', label: 'mask' }, difficulty: 2, cats: ['privesc','network'], desc: 'Enumerate SMB and anonymous FTP shares to discover a writable cron-driven script, hijack it for a reverse shell as user, then escalate to root via a SUID env binary.', tags: ['nmap','smbclient','FTP','cron','SUID env'], file: 'anonymous.md', }, { id: 'gamingserver', title: 'GamingServer', category: 'Privilege Escalation', badgeColor: 'purple', theme: { c1: '#8b5cf6', c2: '#22d3ee', label: 'arcade' }, difficulty: 1, cats: ['privesc','web'], desc: 'Enumerate a hidden web directory to recover an encrypted SSH RSA key, crack the weak passphrase with john, then escalate to root via a privileged LXD container that mounts the host filesystem.', tags: ['gobuster','ssh2john','john','LXD','privesc'], file: 'gamingserver.md', }, { id: 'ignite', title: 'Ignite', category: 'Web Application', badgeColor: 'orange', theme: { c1: '#f97316', c2: '#fbbf24', label: 'fuel-cms' }, difficulty: 1, cats: ['web','privesc'], desc: 'Exploit an unpatched Fuel CMS 1.4 installation via CVE-2018-16763 filter-parameter injection for RCE as www-data, extract hardcoded database credentials, and escalate to root through password reuse and a pty.fork() TTY bypass.', tags: ['nmap','CVE-2018-16763','Fuel CMS','RCE','credential reuse','pty.fork()'], file: 'ignite.html', }, { id: 'chatbot', title: 'Chatbot', category: 'AI / API Enumeration', badgeColor: 'blue', theme: { c1: '#22d3ee', c2: '#a855f7', label: 'evil-gpt' }, difficulty: 1, cats: ['ai','web'], desc: "Bypass the Evil-GPT v2 chatbot by ignoring it entirely — a full TCP scan exposes Ollama's default API on port 11434, then /api/tags and /api/show leak the model's system prompt with the flag baked in. No prompt injection required.", tags: ['nmap','Ollama','/api/show','LLM','prompt leak'], file: 'chatbot.html', }, { id: 'lofi', title: 'Lo-Fi', category: 'LFI / Path Traversal', badgeColor: 'blue', theme: { c1: '#f1e6cf', c2: '#a78bfa', label: 'traverse' }, difficulty: 1, cats: ['web'], desc: "The site loads each 'album' through ?page= and hands it straight to PHP include(). Swap the filename for ../../../../../flag.txt and the filesystem itself plays back the flag — no auth, no fuzzing, just dots and slashes past a depth-shallow blacklist.", tags: ['LFI','path traversal','PHP include','blacklist bypass','curl'], file: 'lofi.html', }, { id: 'bricks', title: 'Bricks Heist', category: 'Web / Forensics', badgeColor: 'orange', theme: { c1: '#dc2626', c2: '#f59e0b', label: 'bricks-heist' }, difficulty: 1, cats: ['web'], desc: "CVE-2024-25600 turns a leaked WordPress nonce into PHP eval(). Post-exploitation chases a miner masquerading as nm-inet-dialog, a hex-then-base64-twice wallet in inet.conf, and a LockBit-attributed Bitcoin trail. Written as a failure audit — the clean path is short; mine wasn't.", tags: ['CVE-2024-25600','WordPress','Bricks Builder','RCE','miner forensics','OFAC','LockBit'], file: 'bricks.html', }, { id: 'vectara', title: 'Vectara', category: 'AI Security', badgeColor: 'blue', theme: { c1: '#22d3ee', c2: '#a855f7', label: 'oracle-9' }, difficulty: 1, cats: ['ai','web'], desc: "Eight-task AI Odyssey CTF aboard the EPOCH-1 generation ship: prompt-inject a relay satellite, poison a model registry, cross-reference corrupted nav data, exploit an agentic medical-bay assistant, and finish with stored XSS + cookie clobbering against a bot-reviewed workflow. Maps cleanly to the OWASP LLM Top 10.", tags: ['prompt injection','OWASP LLM Top 10','AI supply chain','data poisoning','agentic AI','stored XSS','cookie clobbering'], file: 'vectara.html', }, ]; const FILTERS = [ { label: 'all', value: 'all' }, { label: 'web', value: 'web' }, { label: 'privesc', value: 'privesc' }, { label: 'network', value: 'network' }, { label: 'rev-eng', value: 'reverse-engineering' }, { label: 'web3', value: 'web3' }, { label: 'ai', value: 'ai' }, { label: 'subdomain', value: 'subdomain-takeover' }, ]; // Helper — hex to rgb tuple string for rgba(). Accepts #rgb, #rrggbb, #rrggbbaa. // Falls back to orange (249,115,22) if the input isn't a recognizable hex. const FALLBACK_RGB = '249,115,22'; const hexRgb = (hex) => { if (typeof hex !== 'string') return FALLBACK_RGB; let h = hex.trim().replace(/^#/, ''); if (h.length === 3 || h.length === 4) h = h.split('').slice(0, 3).map(c => c + c).join(''); if (h.length !== 6 && h.length !== 8) return FALLBACK_RGB; if (!/^[0-9a-fA-F]{6,8}$/.test(h)) return FALLBACK_RGB; const r = parseInt(h.slice(0, 2), 16); const g = parseInt(h.slice(2, 4), 16); const b = parseInt(h.slice(4, 6), 16); return `${r},${g},${b}`; }; const DiffDots = ({ level, accent = '#f97316' }) => { const accentRgb = hexRgb(accent); return (
diff {[1,2,3].map(i => ( ))}
); }; const WriteupCard = ({ writeup, index }) => { const [hovered, setHovered] = React.useState(false); const { ref, visible } = useScrollReveal(0.1); const navigate = () => { window.location.href = `/writeups/${writeup.id}.html`; }; const theme = writeup.theme || { c1: '#f97316', c2: '#38bdf8', label: 'room' }; const c1 = theme.c1, c2 = theme.c2; const c1rgb = hexRgb(c1), c2rgb = hexRgb(c2); return (
{ if (e.key === 'Enter' || e.key === ' ') { e.preventDefault(); navigate(); } }} onMouseEnter={() => setHovered(true)} onMouseLeave={() => setHovered(false)} style={{ opacity: visible ? 1 : 0, transform: visible ? (hovered ? 'translateY(-4px)' : 'translateY(0)') : 'translateY(28px)', background: hovered ? `linear-gradient(135deg, rgba(${c1rgb},0.08), rgba(${c2rgb},0.04) 60%, rgba(15,23,42,0.95))` : 'rgba(2,6,23,0.85)', border: `1px solid ${hovered ? `rgba(${c1rgb},0.42)` : 'rgba(148,163,184,0.14)'}`, borderRadius: '0.85rem', overflow: 'hidden', cursor: 'pointer', boxShadow: hovered ? `0 18px 50px rgba(0,0,0,0.55), 0 0 0 1px rgba(${c1rgb},0.18), 0 0 32px rgba(${c1rgb},0.18)` : '0 6px 22px rgba(0,0,0,0.35)', backdropFilter: 'blur(16px)', WebkitBackdropFilter: 'blur(16px)', transition: `opacity 0.7s cubic-bezier(0.16,1,0.3,1) ${index * 0.06}s, transform 0.4s cubic-bezier(0.16,1,0.3,1), background 0.25s, border-color 0.25s, box-shadow 0.25s`, display: 'flex', flexDirection: 'column', position: 'relative', }}> {/* Top accent strip (theme gradient) */}
{/* Theme sigil — top right corner glow */}
{/* Terminal chrome bar */}
◇ {theme.label}
{/* Prompt + title */}
root@thm : ~/rooms $ cat {writeup.file}
{writeup.title}
{writeup.category}
{/* Description */}
{writeup.desc}
{/* Footer */}
{writeup.tags.slice(0,3).map(t => {t})}
→
{/* Hover glow bar at bottom — theme gradient */}
); }; // Per-room display code shown inside each room-node diamond. const ROOM_CODES = { mrrobot: 'MR', wonderland: 'WL', tomghost: 'TG', takeover: 'TO', compiled: 'ELF', chatbot: 'AI', wgel: 'WG', epoch: 'EP', passcode: 'EVM', neighbour: 'IDR', nmap: 'NM', anonymous: 'AN', gamingserver: 'GS', ignite: 'IG', bricks: 'BH', lofi: 'LFI', vectara: 'VEC', }; // Four sectors that partition the room-map stage into meaningful quadrants. // Each room is assigned to a sector based on its primary category (cats[0]), // then positioned inside the sector's bounds. Sector labels on the map are // clickable and filter the visible rooms to the sector's categories. const SECTORS = [ { id: 'entry', label: 'entry deck', blurb: 'Recon — port sweeps, name resolution, dangling subdomains.', color: '#4ade80', rgb: '74,222,128', cats: ['network', 'subdomain-takeover'], bounds: { x: [12, 36], y: [22, 40] }, labelPos: { left: '4%', top: '4%' }, }, { id: 'exploit', label: 'exploit wing', blurb: 'Application bugs — RCE, IDOR, command injection, prompt leaks.', color: '#38bdf8', rgb: '56,189,248', cats: ['web', 'ai'], bounds: { x: [54, 92], y: [22, 42] }, labelPos: { right: '4%', top: '4%' }, }, { id: 'lab', label: 'lab bench', blurb: 'Static analysis — ELF reversing, contract storage, model APIs.', color: '#f59e0b', rgb: '245,158,11', cats: ['reverse-engineering', 'web3'], bounds: { x: [12, 36], y: [60, 80] }, labelPos: { left: '4%', bottom: '4%' }, }, { id: 'root', label: 'loot vault', blurb: 'Privilege escalation — SUID, capabilities, container escapes.', color: '#a855f7', rgb: '168,85,247', cats: ['privesc'], bounds: { x: [54, 92], y: [60, 80] }, labelPos: { right: '4%', bottom: '4%' }, }, ]; // Primary-cat → sector lookup. const sectorForRoom = (room) => SECTORS.find(s => s.cats.includes(room.cats[0])) || SECTORS[1]; // Pack each sector's rooms into a roughly square grid inside its bounds. const buildRoomLayout = (writeups) => { const layout = {}; const grouped = {}; for (const w of writeups) { const s = sectorForRoom(w); (grouped[s.id] = grouped[s.id] || []).push(w); } for (const sector of SECTORS) { const rooms = grouped[sector.id] || []; const cols = Math.max(1, Math.ceil(Math.sqrt(rooms.length))); const rows = Math.max(1, Math.ceil(rooms.length / cols)); const [xMin, xMax] = sector.bounds.x; const [yMin, yMax] = sector.bounds.y; const colStep = cols > 1 ? (xMax - xMin) / (cols - 1) : 0; const rowStep = rows > 1 ? (yMax - yMin) / (rows - 1) : 0; rooms.forEach((room, i) => { const col = i % cols; const row = Math.floor(i / cols); layout[room.id] = { x: cols > 1 ? xMin + col * colStep : (xMin + xMax) / 2, y: rows > 1 ? yMin + row * rowStep : (yMin + yMax) / 2, code: ROOM_CODES[room.id] || room.title.slice(0, 2).toUpperCase(), sectorId: sector.id, }; }); } return layout; }; // Match a room against the current filter. Filter is either 'all', a sector // id prefixed with 'sector:', or a single category value. const roomMatchesFilter = (room, filter) => { if (filter === 'all') return true; if (filter.startsWith('sector:')) { const sector = SECTORS.find(s => s.id === filter.slice(7)); return sector ? sector.cats.some(c => room.cats.includes(c)) : false; } return room.cats.includes(filter); }; const SECTOR_META = { web: { label: 'web', color: '#38bdf8' }, privesc: { label: 'privesc', color: '#a855f7' }, network: { label: 'network', color: '#4ade80' }, 'reverse-engineering': { label: 'rev', color: '#f59e0b' }, web3: { label: 'web3', color: '#a78bfa' }, ai: { label: 'ai', color: '#22d3ee' }, 'subdomain-takeover': { label: 'subdomain', color: '#f97316' }, }; const RoomMap = ({ writeups, filter, setFilter }) => { const layout = React.useMemo(() => buildRoomLayout(writeups), [writeups]); const rooms = writeups.map(w => ({ ...w, ...layout[w.id] })); const visibleRooms = rooms.filter(room => roomMatchesFilter(room, filter)); const [selectedId, setSelectedId] = React.useState(rooms[0]?.id); const [scanning, setScanning] = React.useState(false); const scanTimer = React.useRef(null); React.useEffect(() => { if (!visibleRooms.length) return; if (!visibleRooms.some(room => room.id === selectedId)) { setSelectedId(visibleRooms[0].id); } }, [filter]); React.useEffect(() => () => clearInterval(scanTimer.current), []); const selected = rooms.find(room => room.id === selectedId) || rooms[0]; // Per-sector chain: connect rooms within each sector in the order they // appear in WRITEUPS. Produces 4 visual clusters instead of one arbitrary // chain through the whole array. const sectorChains = React.useMemo(() => { const out = []; for (const sector of SECTORS) { const inSector = rooms.filter(r => r.sectorId === sector.id); for (let i = 0; i < inSector.length - 1; i++) { out.push({ from: inSector[i], to: inSector[i + 1], color: sector.color }); } } return out; }, [rooms]); // Highlighted "related rooms" lines for the selected node — pick up to 5 // rooms with overlapping cats so the user sees who's in the same family. const relatedRooms = selected ? rooms.filter(room => room.id !== selected.id && room.cats.some(cat => selected.cats.includes(cat))).slice(0, 5) : []; const startScan = () => { const scanRooms = visibleRooms.length ? visibleRooms : rooms; if (!scanRooms.length) return; clearInterval(scanTimer.current); let i = 0; setScanning(true); setSelectedId(scanRooms[0].id); scanTimer.current = setInterval(() => { i += 1; if (i >= scanRooms.length) { clearInterval(scanTimer.current); scanTimer.current = null; setScanning(false); return; } setSelectedId(scanRooms[i].id); }, 320); }; const openSelected = () => { if (selected) window.location.href = `/writeups/${selected.id}.html`; }; const sectorCounts = Object.keys(SECTOR_META).map(value => ({ value, ...SECTOR_META[value], count: writeups.filter(room => room.cats.includes(value)).length, rgb: hexRgb(SECTOR_META[value].color), })); const sectorCountsById = React.useMemo(() => { const out = {}; for (const sector of SECTORS) { out[sector.id] = writeups.filter(w => sector.cats.some(c => w.cats.includes(c))).length; } return out; }, [writeups]); return (
{SECTORS.map(sector => { const sectorFilter = `sector:${sector.id}`; const isActive = filter === sectorFilter; return ( ); })} {rooms.map((room) => { const matches = roomMatchesFilter(room, filter); const isSelected = selected?.id === room.id; return ( ); })}
); }; const WriteupsScreen = ({ onNavigate }) => { const [filter, setFilter] = React.useState('all'); const [heroVisible, setHeroVisible] = React.useState(false); React.useEffect(() => { const t = setTimeout(() => setHeroVisible(true), 60); return () => clearTimeout(t); }, []); const visible = WRITEUPS.filter(w => roomMatchesFilter(w, filter)); const filterLabel = filter.startsWith('sector:') ? (SECTORS.find(s => s.id === filter.slice(7))?.label.replace(/\s+/g, '-') || filter) : filter; const { displayed: cmdLine } = useTypewriter(`ls ~/rooms --filter=${filterLabel} --sort=date`, 28, 300); // Category counts for the stats strip const counts = { web: WRITEUPS.filter(w => w.cats.includes('web')).length, privesc: WRITEUPS.filter(w => w.cats.includes('privesc')).length, network: WRITEUPS.filter(w => w.cats.includes('network')).length, web3: WRITEUPS.filter(w => w.cats.includes('web3')).length, }; return (
{/* Back */} { e.preventDefault(); onNavigate('home'); }} style={{ display: 'inline-flex', alignItems: 'center', gap: '0.4rem', color: '#38bdf8', fontSize: '0.78rem', fontFamily: 'ui-monospace,monospace', padding: '0.32rem 0.75rem', border: '1px solid rgba(56,189,248,0.2)', borderRadius: '4px', textDecoration: 'none', marginBottom: '2.5rem', background: 'rgba(56,189,248,0.05)', transition: 'all 0.15s', }}> ← cd .. {/* Hero */}
{/* Decorative atomic sigil — top right behind title */} TryHackMe

Challenge Writeups

Documented solutions, methodology breakdowns, and lessons learned from TryHackMe rooms — each one themed to the personality of the room, focused on understanding the why behind each technique.

{ window.location.href = '/tryhackme-learning.html'; }}>Browse learning rooms → onNavigate('home')}>← Home
{/* Stats strip */}
{[ { n: WRITEUPS.length, label: 'rooms', c: '#f97316' }, { n: counts.web, label: 'web', c: '#38bdf8' }, { n: counts.privesc, label: 'privesc', c: '#a855f7' }, { n: counts.network, label: 'network', c: '#4ade80' }, { n: counts.web3, label: 'web3', c: '#a78bfa' }, ].map(s => (
{s.n} {s.label}
))}
{/* Terminal command bar */}
${' '} {cmdLine} █
● {visible.length} results {WRITEUPS.length} total
{/* Filter bar */}
filter: {FILTERS.map(f => ( ))}
{visible.map((w, i) => ( ))} {visible.length === 0 && (
ERROR: No writeups match filter "{filter}"
)} {/* Coming soon */} {filter === 'all' && (
◇ coming_soon
root@thm:~/rooms$ cat ???.md
Next writeup...
More rooms and writeups will appear here as they are completed.
)}
); }; Object.assign(window, { WriteupsScreen, WRITEUPS, FILTERS });