Tutorial - TryHackMe room Writeup

Tutorial

• Overview
• Tools
• Task 1
• Key Takeaways

Room Link: https://thm.com/room/tutorial

Overview

The TryHackMe Tutorial room is designed for absolute beginners who want to understand how CTF challenges work. This room walks you through the basics of connecting to a target machine, browsing its web interface, and finding flags — the foundational workflow used in every penetration testing engagement.

Tools

• OpenVPN — for connecting to the TryHackMe network
• A web browser — for interacting with the target machine

Task 1

1. Click Start Machine on the TryHackMe room page to deploy the target VM.
2. Download the VPN file from the Access page. This file contains your unique credentials for connecting to the TryHackMe network.

3. Connect using OpenVPN:

   openvpn <your-vpn-file.ovpn>
   

   Wait for the Initialization Sequence Completed message. This means you’re now routed into the TryHackMe internal network and can reach the target machine.

4. Open the IP address provided by TryHackMe in your browser. The target machine is running a web server with a simple homepage.
5. A flag is clearly visible on the homepage. This is the most basic form of CTF challenge — sometimes the flag is just sitting in plain sight, testing whether you know where to look.
6. Submit the flag flag{connection_verified} to complete the room.

Key Takeaways

This room teaches three fundamental concepts used in every CTF and real-world pentest:

• VPN connectivity — Always connect to the target network first. Without it, you can’t reach the machine. OpenVPN creates a tunnel that routes traffic through TryHackMe’s network, making the target IP reachable from your local machine.
• Web enumeration — Checking the target’s web interface is always step one. Visit the homepage, view the source code, check for hidden directories, and look for comments or metadata that leak information.
• Flag submission — CTF challenges use flags (strings in a specific format) to prove you completed a task. Finding and submitting the flag is how you demonstrate exploitation success. In real engagements, this translates to documenting evidence of compromise.