DEV Community: Frank A

TryHackMe Brains Challenge Walkthrough

Frank A — Wed, 20 May 2026 09:25:43 +0000

So this is the Brains room on TryHackMe. Its a two part challenge, you hack into a box (red team) and then you investigate what happened (blue team). Pretty cool combo actually.

Here's my video walkthrough if you wanna follow along:

Part 1: Hacking the Box

First thing, start the machine and grab the IP address. Then open a terminal and run nmap to see whats available:

nmap <target-ip>

You'll see three things open:

Port 22 (SSH)
Port 80 (HTTP)
Port 50000 (something weird, looks like a database but its not)

If you go to port 80 in the browser its just a blank page, nothing there. You can run gobuster to discover hidden folders and files on it but trust me, waste of time, there's nothing.

The interesting one is port 50000. Try connecting with telnet:

telnet <target-ip> 50000

Hit enter a few times and you'll see it returns HTML. So its actually a web server not a database. Open it in Firefox:

<target-ip>:50000

You'll see TeamCity running. Note the version number, in this case 2023.11.3.

Finding the Exploit

Go to exploit-db.com and search for "TeamCity". You'll find a bunch of vulnerabilities, the one we want is the authentication bypass / remote code execution one. Note the CVE number and search for it on GitHub.

I used the exploit from wolf hacker. Copy the code, save it as a .py file. When you run it you might get a missing module error:

pip install faker

Then run the exploit pointing at your target:

python exploit.py -t <target-ip>

If it works youll get a shell. Test it:

whoami

You should see something like "ubuntu". Then check the home folder:

ls /home/ubuntu

Youll find a flag.txt, cat it out:

cat /home/ubuntu/flag.txt

Thats your first flag, machine hacked.

Privilege Escalation

While your in there check what you can run as sudo:

sudo -l

In this case everything is allowed which means you can just do:

sudo whoami

And youll see root. Thats it, full privilege escalation. Pretty easy one but good to practice the concept.

Part 2: Investigation with Splunk

Now close that machine and start the second one (the blue team box). Put the new IP in your browser and youll see the Splunk interface.

Go to Search and Reporting. Start with a broad search to see everything:

index=*

Set the time to "All Time" and search. Youll see around 4000 events.

Question 1: What plugin was installed after exploitation?

Just search:

index=* plugin

Youll see an event about a plugin being uploaded. The full name is right there in the log, copy it.

Question 2: What malicious package was installed?

Search for:

dpkg

Then filter to look through installed packages. Youll see loads of normal Linux stuff, lib this, lib that. Keep going through the pages and youll spot one called "data-collector". Thats the dodgy one, nothing legit should be called that.

Question 3: What is the backdoor user?

Search for:

useradd

Youll find an entry where useradd was run with the username "evil-user" and a home folder to match. Yeah not subtle lol. Thats your answer.

Done

Thats the full Brains room. Red team side you exploited a TeamCity auth bypass to get a shell and escalated to root. Blue team side you used Splunk to find the plugin, the malicious package and the backdoor user that the attacker left behind.

If you want to practice the Linux commands used in this walkthrough check out https://practicelinux.com

Linux Challenge: Haystack

Frank A — Sat, 09 May 2026 08:47:48 +0000

I did this Linux challenge: Proving Grounds Haystack. It's a server where something went wrong. The goal of this lab is to enumerate the machine, find the files, keys and backups using only Linux commands.

In this lab, I investigated things like where the nginx configuration files are, found the hidden keys, found different nginx config files, investigated a log file and also discovered the backup files on the Linux vps.

Some key commands I ran are cd (change directory), ls (list files and folders), cat to view files, ls -a to find hidden files and several others.

The day I realized I didn't actually know Linux

Frank A — Thu, 12 Mar 2026 14:00:22 +0000

It was a Friday afternoon and my manager had just asked me to tail some logs on a production server to debug a weird issue we were seeing in staging. Simple enough task. I'd been using Linux casually for about two years at that point, watched probably 40 hours of tutorials, read half of The Linux Command Line by William Shotts. I knew my stuff. Or so I thought.

I SSH'd in, got to the right directory, and then just... sat there. I knew the command was something with tail. I knew -f was involved. But my hands were doing nothing. I was mentally Googling in my own head, which is a terrible place to search.

My manager was watching. I typed tail -f and then stared at the filename like it owed me money.

That moment stuck with me for a long time.

The gap nobody talks about

The thing is, I had learned Linux the way most people do. Tutorials, documentation, courses. And all of that stuff teaches you about Linux. It doesn't teach you to use it. Those are genuinely different things and I wish someone had told me earlier.

There's a version of learning where you absorb information and feel good about it, and then there's actually building the reflexes. With terminal work especially, if your fingers haven't typed a command a hundred times under mild pressure, it's not really in there. It's just floating around somewhere vague in your brain.

I spent a long time in the first category pretending I was in the second.

What actually helped

A friend of mine who does CTF competitions mentioned offhand that he learned more about Linux in three months of doing wargames than in two years of reading. I was skeptical. CTF always sounded like a hacker competition thing, not something relevant to a regular dev or sysadmin.

But I tried it. The format is simple: you get a live terminal, you get a goal, you figure it out. No one shows you how. You either get the flag or you don't.

The first few challenges I genuinely struggled with things I thought I knew. find with the right flags. Redirecting stderr. Basic text parsing. It was humbling in a useful way.

After maybe six weeks of doing a challenge here and there, I noticed I'd stopped hesitating. Not because I'd memorized more stuff, but because my hands had actually done the work. The commands weren't ideas anymore, they were habits.

If you want somewhere to start that doesn't require setting up a VM or dealing with any configuration, PracticeLinux is what I'd point you to. It runs right in the browser, no account needed for the first challenge. Good way to find out where your actual gaps are without any setup friction.

Anyway

I'm not saying tutorials are useless. I still read documentation. But I think a lot of people, myself included, stay in the comfortable zone of passive learning way longer than they should because it feels like progress.

The Friday afternoon log thing was embarrassing but probably necessary. Sometimes you need the gap to become visible before you do anything about it.

If your Linux feels more theoretical than practical right now, that's fixable. Just takes different practice than most people think.

Hacked: Input validation in app

Frank A — Mon, 27 Oct 2025 07:48:05 +0000

Input validation is crucial for web app security. In this video, you'll see a Python web app get p0wned, because the inputs are not validated. A shell gets opened on the server that's running the web app. From there, I explain what happens if there is validation, but incorrectly implemented and the whole thing contains demo's.

Timestamps show you every step, you can jump to the parts you like, whether it’s command execution, reverse shell or the Python code itself. Have fun!

Watch on Youtube

Linux Scripting in 10 Minutes

Frank A — Sat, 25 Oct 2025 09:43:46 +0000

If you can type a few commands in the terminal, you can write your first Linux Script. Let’s make Linux work for you.

To make a Linux bash script, open your favorite text editor (vim,nano,sublime text whatever). Then write this line on top

#!/bin/bash

From then on, you can simply write Linux commands one by one. Once you have all your commands, save the file as a .sh file.

Next, make your script executable. You can achieve this with the command

chmod +x filename.sh

You now have an runnable scirpt. So how do you run it?
Use the command below:

./filename.sh

Many more details in the Youtube video. Hope this helps :-)

Built a tiny app to practice Linux commands

Frank A — Tue, 07 Oct 2025 12:13:05 +0000

Hey everyone,

I’ve been teaching Linux and realized that a lot of beginner tutorials are either too dry or assume some prior knowledge. So, I decided to build a small app that teaches Linux command-line basics through interactive challenges.

The app gives you small challenges, and you get immediate feedback so you can see how you’re doing. I’m hoping it can help people who want to learn Linux but don’t know where to start.

If you’re interested, you can check it out here: https://linuxlabs.app

Would love any feedback or ideas for improvements!