Biohazard Room — TryHackMe CTF Writeup | Full Walkthrough

A Resident Evil themed CTF that takes you through mansions, ciphers, steganography, and all the way to root

The Story Begins

You wake up. There’s a mansion. There’s a biohazard. And somewhere inside, Chris is locked in a jail cell. Classic Resident Evil energy — and this TryHackMe room leans fully into it. Let’s survive.

Step 1: Recon — Know Your Mansion

Before kicking down any doors, we scan:

bash

sudo nmap -p21,22,80 -sV -sC -T4 10.49.188.111 -Pn

Three open ports greet us:

• Port 21 — FTP (vsftpd 3.0.3)
• Port 22 — SSH (OpenSSH 7.6p1)
• Port 80 — Apache web server titled “Beginning of the end”

Dramatic title. I like it. Let’s explore the web server first.

Step 2: Exploring the Mansion — Web Enumeration

Browsing to /mansionmain/ and checking the page source reveals a breadcrumb:

html

<!-- It is in the /diningRoom/ -->

The mansion starts talking. We follow.

Step 3: The Dining Room — First Emblem

At /diningRoom/, there's an emblem on the wall. We take it, obviously.

The page also gives us a name — rebecca — and a suspicious encoded string:

klfvg ks r wimgnd biz mpuiui ulg fiemok tqod...

Smells like a cipher. We park it and keep exploring. Source code hints at the_great_shield_key.html:

Submitting the emblem flag via POST reveals a Base64 hint:

SG93IGFib3V0IHRoZSAvdGVhUm9vbS8=  →  How about the /teaRoom/

The mansion is literally giving us directions now.

Step 4: The Tea Room — Lockpick

Barry left a lockpick for Jill. Gentleman. We grab it:

Barry also suggests visiting the /artRoom/ — where a map on the wall lays out every location in the mansion. Our roadmap for the rest of the room.

Barry also suggests visiting the /artRoom/ — where a map on the wall lays out every location in the mansion. Our roadmap for the rest of the room.

Step 5: The Bar Room — Music Sheet & Hidden URL

At /barRoom/, a note says "moonlight sonata" — encoded in Base32:

NV2XG2LDL5ZWQZLFOR5TGNRSMQ3TEZDFMF..........................

Submitting the music flag unlocks a secret URL:

/barRoom35……………../gold_emblem.php

Step 6: Dining Room 2F — ROT13 & Blue Gem

Source code on the second floor contains ROT13 encoded text:

Lbh trg gur oyhr trz...  →  You get the blue gem by pushing the status to the lower floor. Visit sapphire.html

Visiting /diningRoom/sapphire.html:

Step 7: Collecting the 4 Crests — The Crypto Gauntlet

This is where it gets fun. Four rooms, four crests, each encoded differently:

Crest 1 — tigerStatusRoom

Encoding: Base64 → Base32

S0pXRkVVS0pKQkxIVVdTWUpFM0VTUlk9
        ↓ decode Base64
KJWFEUKJJBLHUWSYJE3ESRY=
        ↓ decode Base32
RlRQIHVzZXI6IG   ← partial FTP string

Crest 2 — galleryRoom (note.txt)

Encoding: Base32

GVFWK5KHK5WTGTCILE4DKY3DNN4GQQRTM5AVCTKE
        ↓ decode Base32
        ↓ decode Base58
h1bnRlciwgRlRQIHBh   ← next chunk

Crest 3 — armorRoom

Encoding: Base64 → Binary → ASCII

The long binary string decodes in three steps — Base64 first reveals raw binary (00110110 00110011...), which converts to ASCII text, producing:

c3M6IHlvdV9jYW50X2h   ← next chunk

Crest 4 — attic

Encoding: Base58 → Base64

gSUERauVpvKzRpyPpuYz66JDmRTbJubaoArM6CAQsnVwte6zF9J4GGYyun3k5qM9ma4s
        ↓ decode Base58
pZGVfZm9yZXZlcg==   ← final chunk

Combine All 4 Crests

RlRQIHVzZXI6IG  +  h1bnRlciwgRlRQIHBh  +  c3M6IHlvdV9jYW50X2h  +  pZGVfZm9yZXZlcg==

Full string:

RlRQIHVzZXI6IGh1bnRlciwgRlRQIHBhc3M6IHlvdV9jYW50X2hpZGVfZm9yZXZlcg==

The mansion just handed us FTP credentials hidden across four rooms in four different ciphers. Respect.

Step 8: FTP Login — Steganography Trio

Logged in as hunter, the FTP server holds two text files and three suspicious JPG images. The important note from Barry mentions a /hidden_closet/ and a GPG encrypted helmet key.

Time to interrogate those images:

001-key.jpg → Steghide extraction:

bash

steghide extract -sf 001-key.jpg
# Output: cGxhbnQ0Ml9jYW

002-key.jpg → Exiftool metadata:

bash

exiftool 002-key.jpg
# Comment: 5fYmVfZGVzdHJveV9

003-key.jpg → Binwalk + manual extraction:

bash

binwalk -e 003-key.jpg
dd if=003-key.jpg of=hidden.zip bs=1 skip=1930
# Output: 3aXRoX3Zqb2x0

Combining all three pieces and decoding from Base64:

Using this as the GPG passphrase to decrypt helmet_key.txt.gpg:

helmet_key{458493193501d2b94..............}  

Step 9: Study Room & Hidden Closet — SSH Credentials

/studyRoom serves a doom.tar.gz archive. Extracting it reveals:

SSH user: umbrella_guest

/hiddenCloset contains a Vigenère cipher and a wolf medal. The cipher decodes using the key albert (found from Chris's note — MO Disk 2):

SSH password: T_virus_rules

Step 10: SSH In — Finding Chris

Logging in as umbrella_guest, a quick find command locates the hidden jail cell:

bash

find / -iname "*chris*" 2>/dev/null

Chris hands us MO Disk 2, key: albert — which we already used. And the Vigenère cipher in the closet decodes to Wesker's password:

stars_members_are_my_guinea_pig

Step 11: Root — Wesker Had Full Sudo All Along

bash

sudo -l

Of course Wesker had unrestricted sudo. The man is the final boss.

Key Takeaways

• Hidden HTML comments are breadcrumbs — always read source code
• Layered encoding (Base64 inside Base32 inside binary) is common in CTFs; don’t stop at one decode
• Steganography hides secrets in plain sight — always check images with steghide, exiftool, and binwalk
• Vigenère ciphers need a key; look for one nearby in the story
• A user with (ALL : ALL) ALL sudo is effectively root — audit sudo permissions always

Enjoyed the writeup? Follow for more TryHackMe & HackTheBox walkthroughs. Drop a comment if you got stuck anywhere — happy to help you survive the mansion. 🧟