Biohazard Room — TryHackMe Writeup

The Story Begins

You wake up. There’s a mansion. There’s a biohazard. And somewhere inside, Chris is locked in a jail cell. Classic Resident Evil energy — and this TryHackMe room leans fully into it. Let’s survive.

Step 1: Recon — Know Your Mansion

Before kicking down any doors, we scan:

sudo nmap -p21,22,80 -sV -sC -T4 10.49.188.111 -Pn
rustscan -a 10.49.177.82 -r 1-65535 --ulimit 5000 -- -sC -sV

Press enter or click to view image in full size

Three open ports greet us:

• Port 21 — FTP (vsftpd 3.0.3)
• Port 22 — SSH (OpenSSH 7.6p1)
• Port 80 — Apache web server titled “Beginning of the end”

Dramatic title. I like it. Let’s explore the web server first.

Step 2: Exploring the Mansion — Web Enumeration

Browsing to /mansionmain/ and checking the page source reveals a breadcrumb:

<!-- It is in the /diningRoom/ -->

The mansion starts talking. We follow.

Press enter or click to view image in full size

Step 3: The Dining Room — First Emblem

At /diningRoom/, there's an emblem on the wall. We take it, obviously.

Press enter or click to view image in full size

The page also gives us a name — rebecca — and a suspicious encoded string:

klfvg ks r wimgnd biz mpuiui ulg fiemok tqod...

Press enter or click to view image in full size

Smells like a cipher. We park it and keep exploring. Source code hints at the_great_shield_key.html:

Press enter or click to view image in full size

Submitting the emblem flag via POST reveals a Base64 hint:

SG93IGFib3V0IHRoZSAvdGVhUm9vbS8=  →  How about the /teaRoom/

The mansion is literally giving us directions now.

Press enter or click to view image in full size

Step 4: The Tea Room — Lockpick

Barry left a lockpick for Jill. Gentleman. We grab it:

Barry also suggests visiting the /artRoom/ — where a map on the wall lays out every location in the mansion. Our roadmap for the rest of the room.

Press enter or click to view image in full size

Barry also suggests visiting the /artRoom/ — where a map on the wall lays out every location in the mansion. Our roadmap for the rest of the room.

Step 5: The Bar Room — Music Sheet & Hidden URL

At /barRoom/, a note says "moonlight sonata" — encoded in Base32:

NV2XG2LDL5ZWQZLFOR5TGNRSMQ3TEZDFMF..........................

Press enter or click to view image in full size

Submitting the music flag unlocks a secret URL:

/barRoom35……………../gold_emblem.php

Press enter or click to view image in full size

Step 6: Dining Room 2F — ROT13 & Blue Gem

Source code on the second floor contains ROT13 encoded text:

Press enter or click to view image in full size

Press enter or click to view image in full size

Lbh trg gur oyhr trz...  →  You get the blue gem by pushing the status to the lower floor. Visit sapphire.html

Visiting /diningRoom/sapphire.html:

Press enter or click to view image in full size

Step 7: Collecting the 4 Crests — The Crypto Gauntlet

This is where it gets fun. Four rooms, four crests, each encoded differently:

Crest 1 — tigerStatusRoom

Encoding: Base64 → Base32

Press enter or click to view image in full size

S0pXRkVVS0pKQkxIVVdTWUpFM0VTUlk9
        ↓ decode Base64
KJWFEUKJJBLHUWSYJE3ESRY=
        ↓ decode Base32
RlRQIHVzZXI6IG   ← partial FTP string

Crest 2 — galleryRoom (note.txt)

Encoding: Base32

Press enter or click to view image in full size

GVFWK5KHK5WTGTCILE4DKY3DNN4GQQRTM5AVCTKE
        ↓ decode Base32
        ↓ decode Base58
h1bnRlciwgRlRQIHBh   ← next chunk

Crest 3 — armorRoom

Encoding: Base64 → Binary → ASCII

Press enter or click to view image in full size

The long binary string decodes in three steps — Base64 first reveals raw binary (00110110 00110011...), which converts to ASCII text, producing:

c3M6IHlvdV9jYW50X2h   ← next chunk

Crest 4 — attic

Encoding: Base58 → Base64

Press enter or click to view image in full size

gSUERauVpvKzRpyPpuYz66JDmRTbJubaoArM6CAQsnVwte6zF9J4GGYyun3k5qM9ma4s
        ↓ decode Base58
pZGVfZm9yZXZlcg==   ← final chunk

Combine All 4 Crests

RlRQIHVzZXI6IG  +  h1bnRlciwgRlRQIHBh  +  c3M6IHlvdV9jYW50X2h  +  pZGVfZm9yZXZlcg==

Full string:

RlRQIHVzZXI6IGh1bnRlciwgRlRQIHBhc3M6IHlvdV9jYW50X2hpZGVfZm9yZXZlcg==

Press enter or click to view image in full size

The mansion just handed us FTP credentials hidden across four rooms in four different ciphers. Respect.

Step 8: FTP Login — Steganography Trio

Logged in as hunter, the FTP server holds two text files and three suspicious JPG images. The important note from Barry mentions a /hidden_closet/ and a GPG encrypted helmet key.

Time to interrogate those images:

001-key.jpg → Steghide extraction:

steghide extract -sf 001-key.jpg
# Output: cGxhbnQ0Ml9jYW

002-key.jpg → Exiftool metadata:

exiftool 002-key.jpg
# Comment: 5fYmVfZGVzdHJveV9

003-key.jpg → Binwalk + manual extraction:

binwalk -e 003-key.jpg
dd if=003-key.jpg of=hidden.zip bs=1 skip=1930
# Output: 3aXRoX3Zqb2x0

Combining all three pieces and decoding from Base64:

Press enter or click to view image in full size

Using this as the GPG passphrase to decrypt helmet_key.txt.gpg:

helmet_key{458493193501d2b94..............}

Step 9: Study Room & Hidden Closet — SSH Credentials

/studyRoom serves a doom.tar.gz archive. Extracting it reveals:

SSH user: umbrella_guest

/hiddenCloset contains a Vigenère cipher and a wolf medal. The cipher decodes using the key albert (found from Chris's note — MO Disk 2):

SSH password: T_virus_rules

Press enter or click to view image in full size

Step 10: SSH In — Finding Chris

Logging in as umbrella_guest, a quick find command locates the hidden jail cell:

find / -iname "*chris*" 2>/dev/null

Press enter or click to view image in full size

Chris hands us MO Disk 2, key: albert — which we already used. And the Vigenère cipher in the closet decodes to Wesker's password:

stars_members_are_my_guinea_pig

Press enter or click to view image in full size

Step 11: Root — Wesker Had Full Sudo All Along

sudo -l
cd /root
ls 
cat root.txt

Of course Wesker had unrestricted sudo. The man is the final boss.

Press enter or click to view image in full size