https://mrbeetrootpwn.com/write-ups/tryhackme/Recent content in TryHackMe on CyberSec WriteupsHugoen-usSun, 23 Aug 2026 00:00:00 +0000https://mrbeetrootpwn.com/write-ups/tryhackme/thm-athena/Sun, 23 Aug 2026 00:00:00 +0000https://mrbeetrootpwn.com/write-ups/tryhackme/thm-athena/Linux machine chaining SMB enumeration, new-line command injection on an in-development router panel, cron job abuse, and a patched Diamorphine LKM rootkit for root.https://mrbeetrootpwn.com/write-ups/tryhackme/thm-hollowshell/Wed, 12 Aug 2026 00:00:00 +0000https://mrbeetrootpwn.com/write-ups/tryhackme/thm-hollowshell/Web challenge exploiting a ZIP-based asset upload through magic-byte forgery and a Zip Slip path traversal to plant a malicious Gunicorn hook.https://mrbeetrootpwn.com/write-ups/tryhackme/thm-towelonthesunbed/Wed, 12 Aug 2026 00:00:00 +0000https://mrbeetrootpwn.com/write-ups/tryhackme/thm-towelonthesunbed/Web challenge exploiting a TOCTOU race condition in a daily reward-claim endpoint using Burp Suite’s parallel Repeater requests to unlock a restricted vault.https://mrbeetrootpwn.com/write-ups/tryhackme/thm-donotdisturb/Tue, 11 Aug 2026 00:00:00 +0000https://mrbeetrootpwn.com/write-ups/tryhackme/thm-donotdisturb/Linux boot2root combining a NoSQL authentication bypass, Node.js SSTI, Node inspector abuse, and disk-group privilege escalation.https://mrbeetrootpwn.com/write-ups/tryhackme/thm-sqhell/Sun, 09 Aug 2026 00:00:00 +0000https://mrbeetrootpwn.com/write-ups/tryhackme/thm-sqhell/Web challenge working through authentication bypass, header-based blind SQL injection, UNION-based extraction, and a second-order SQL injection.https://mrbeetrootpwn.com/write-ups/tryhackme/thm-thatstheticket/Fri, 07 Aug 2026 00:00:00 +0000https://mrbeetrootpwn.com/write-ups/tryhackme/thm-thatstheticket/TryHackMe web challenge pairing a stored XSS payload with DNS-based data exfiltration and credential brute forcing to take over an admin account.https://mrbeetrootpwn.com/write-ups/tryhackme/thm-hammer/Wed, 29 Jul 2026 00:00:00 +0000https://mrbeetrootpwn.com/write-ups/tryhackme/thm-hammer/Web application challenge chaining OTP brute forcing, a rate-limit bypass, JWT key manipulation, and remote command execution.