As of 22 July 2026, the official TryHackMe Red Teaming learning path does not contain any dedicated challenge rooms. This repository therefore includes a separate selection of suggested TryHackMe challenges that align with Sections 2-6 of the pathway; these are personal recommendations and are not official components of the learning path. The pathway will continue to be monitored, and this repository will be updated if TryHackMe adds official challenges, an examination or any other relevant content.
This repository contains my personal TryHackMe writeups, study notes and walkthroughs from the TryHackMe Red Teaming learning path.
The purpose of this repository is to document my methodology, commands, observations, mistakes, troubleshooting steps and lessons learned while developing the skills required to conduct authorised adversary emulation exercises. These notes are intended for revision, portfolio development, technical reference and continuous improvement.
Each writeup is based on work completed within an authorised TryHackMe training environment. The rooms, networks and systems covered are intentionally designed for cyber security education, practical exploitation and controlled experimentation.
Where relevant, the writeups may include IP addresses assigned during an individual lab session. Testing is performed using either the TryHackMe AttackBox or my own Kali Linux virtual machine connected to the TryHackMe network through OpenVPN.
PLEASE NOTE: This repository focuses on the complete Red Teaming learning path. The material progresses beyond traditional vulnerability assessment and penetration testing by examining how an operator may emulate realistic adversary activity across multiple stages of an engagement.
The format of each entry will vary according to the room, objective and level of complexity. Some rooms may focus on a single technique, while others may require several weaknesses to be chained together into a full exploitation path.
Important
This repository will never contain material taken from TryHackMe professional certification examinations or other restricted assessments.
Flags, passwords, cracked credentials, private keys, tokens and other sensitive values will not be published. Where such a value is required to explain the methodology, it will be replaced with a clearly marked placeholder.
These notes are not intended to replace independent learning. Try the room first, make mistakes, investigate the evidence and only then compare approaches. That is where the useful learning happens.
If you are looking for any assistance, answers, guides, specific walkthroughs you will NOT find any of those here, help/assistance is limited, but available via the TryHackMe Discord.
Depending on the room, module and learning objective, a writeup may contain:
- Room and module overview;
- Learning objectives;
- Red team engagement planning and operational security;
- Scope and authorised target information;
- Attacker and target IP address details;
- Lab preparation and connectivity checks;
- Threat intelligence and operational planning;
- Passive and active reconnaissance;
- Host, service and Active Directory enumeration;
- Active Directory compromise and persistence;
- Initial access methodology;
- Password attack methodology;
- Weaponisation and phishing;
- Phishing infrastructure and delivery concepts;
- Command and control configuration;
- Payload generation and execution;
- Shell stabilisation and session management;
- Windows privilege escalation;
- Local and domain persistence;
- Credential harvesting;
- Lateral movement and network pivoting;
- Data staging and exfiltration;
- Windows internals and API analysis;
- Antivirus and endpoint security evasion;
- Obfuscation and signature evasion;
- User Account Control bypass methodology;
- Runtime detection evasion;
- Logging and monitoring evasion;
- Living-off-the-land techniques;
- Firewall and sandbox evasion;
- Commands and selected sanitised output;
- Mistakes, troubleshooting and alternative approaches;
- Key findings and lessons learned;
- Detection opportunities and defensive recommendations; and
- References and supporting documentation.
Writeups are intended to explain the methodology and decision-making process rather than provide a simple list of answers.
Learning Path: Red Teaming
The TryHackMe Red Teaming path is designed to develop the skills required to execute adversary attack emulations as a Red Team Operator. It focuses on conducting realistic engagements in complex environments and challenging an organisation's defensive capability.
At the time this README was created, the path contained six sections, 36 hands-on labs and an estimated completion time of approximately 51 hours.
| Section | Focus Area |
|---|---|
| Red Team Fundamentals | Engagement concepts, threat intelligence, operational security and command and control. |
| Initial Access | Reconnaissance, weaponisation, password attacks and phishing. |
| Post Compromise | Host discovery, enumeration, privilege escalation, persistence, lateral movement, pivoting and data exfiltration. |
| Host Evasions | Windows internals, antivirus evasion, obfuscation, UAC bypass, runtime evasion and logging evasion. |
| Network Security Evasion | Network security controls, firewall evasion and sandbox evasion. |
| Compromising Active Directory | Breaching, enumerating, exploiting and persisting within Active Directory environments. |
The official Red Teaming learning path does not currently contain dedicated challenge rooms. The following TryHackMe challenges have therefore been selected as suitable opportunities to apply the knowledge developed throughout Sections 2-6 of the pathway.
These rooms are not official components of the Red Teaming pathway. They have been grouped according to their strongest practical alignment, although several challenges cover techniques from more than one section.
| No. | Section | Difficulty | Status | Challenge | Why It Fits |
|---|---|---|---|---|---|
| 1 | Initial Access |  |
 |
Capture! | Develops initial access skills through login-form analysis, password attacks and the circumvention of application-level rate limiting. |
| 2 | Initial Access | |
|
Anthem | Reinforces reconnaissance, open-source intelligence gathering, credential discovery and the identification of a viable route into a Windows host. |
| 3 | Post Compromise |  |
|
GoldenEye | Requires continued enumeration after service discovery, credential reuse and progression through several services to deepen access within the target. |
| 4 | Post Compromise | |
|
Relevant | Provides a complete post-compromise workflow involving host enumeration, exploitation, privilege escalation and validation of impact within a Windows environment. |
| 5 | Post Compromise |  |
|
Retro | Builds post-compromise skills through Windows enumeration, local privilege escalation and the identification of alternative routes to higher privileges. |
| 6 | Host Evasions | |
|
Blueprint | Provides a Windows environment in which payload selection, execution methods and interaction with host protections can be considered alongside credential recovery and privilege escalation. |
| 7 | Host Evasions | |
|
Enterprise | Encourages careful Windows tradecraft, controlled tool execution and consideration of host-based defensive controls while progressing towards compromise of a domain controller. |
| 8 | Network Security Evasion | |
|
Hack Back | Supports network evasion practice by requiring careful traffic generation, selective service interaction and awareness of how offensive activity may be detected across the environment. |
| 9 | Network Security Evasion | |
|
RazorBlack | Provides opportunities to practise controlled enumeration, authentication abuse and lateral movement while considering the network controls that may expose or restrict those actions. |
| 10 | Network Security Evasion | |
|
Fusion Corp | Simulates a return engagement where the operator must identify alternative attack paths, adapt network activity and work around controls introduced after an earlier compromise. |
| 11 | Compromising Active Directory | |
|
Reset | Applies Active Directory enumeration, credential access, lateral movement and domain compromise techniques within a simulated corporate environment. |
| 12 | Compromising Active Directory | |
|
Operation Endgame | Provides an advanced Active Directory attack scenario requiring the discovery and exploitation of domain-level weaknesses to achieve full compromise. |
| 13 | Compromising Active Directory | |
|
Attacktive Directory | Reinforces Active Directory enumeration, Kerberos-based credential attacks and the progression from an initial foothold towards domain compromise. |
Note
TryHackMe may update room names, URLs, ordering or path content. Direct room links will be added or corrected as each module is completed and documented.
| Status | Meaning |
|---|---|
|
The room has been selected but documentation has not started. |
 |
The room is currently being completed and documented. |
 |
The writeup has been published. |
 |
The room or writeup is no longer actively maintained. |
 |
A lab or room issue has been encountered and reported. |
The tools used will vary according to the room, engagement stage and target behaviour. The following list is representative rather than exhaustive.
| Reconnaissance and Enumeration | Initial Access and Credentials |
|---|---|
| Nmap | Burp Suite |
| RustScan | Hydra |
| Gobuster | John the Ripper |
| ffuf | Hashcat |
| Feroxbuster | Responder |
| Amass | Evilginx2 |
| theHarvester | GoPhish |
| Dig | Social-Engineer Toolkit |
| Wireshark | msfvenom |
| Scapy | Netcat |
| Post Compromise and Active Directory | Evasion and Command and Control |
|---|---|
| NetExec | PowerShell |
| Impacket | Windows API |
| BloodHound | Metasploit Framework |
| Evil-WinRM | Sliver |
| Mimikatz | Covenant |
| Rubeus | Cobalt Strike |
| PowerView | Veil |
| SharpHound | Sysinternals |
| Chisel | LOLBAS |
| Sshuttle | Donut |
| Reference | Primary Use |
|---|---|
| MITRE ATT&CK | Adversary tactics, techniques and procedure mapping. |
| LOLBAS | Windows living-off-the-land binaries, scripts and libraries. |
| GTFOBins | Unix binary abuse and privilege escalation reference. |
| HackTricks | Penetration testing and red teaming reference material. |
| PayloadsAllTheThings | Payload examples and exploitation techniques. |
| SecLists | Wordlists for enumeration, fuzzing and password attacks. |
On my Kali Linux system, SecLists wordlists are accessed from:
/usr/share/wordlists/seclists/
Red team activity is not simply a louder version of penetration testing. Operational security affects how infrastructure, payloads, communications and operator actions are planned and managed.
Within these controlled labs, I aim to consider:
- What information an action may expose;
- What logs or alerts an action may generate;
- Whether a technique is proportionate to the objective;
- Whether an alternative approach is less detectable;
- How infrastructure or tooling may be attributed;
- Whether collected data is handled responsibly; and
- When the exercise objective has been met and activity should stop.
These principles are documented for educational purposes and applied only within authorised training environments.
My general workflow is:
- Confirm the authorised scope, target IP address and
tun0IP address. - Review the stated learning objective and expected engagement stage.
- Verify VPN connectivity and name resolution.
- Conduct passive reconnaissance where appropriate.
- Perform active host, port, service and application enumeration.
- Identify potential initial access routes.
- Validate assumptions carefully and avoid unnecessary disruption.
- Establish and manage an initial foothold.
- Enumerate the local host, users, privileges, services and defensive controls.
- Escalate privileges where permitted by the room.
- Establish persistence only when required by the learning objective.
- Harvest credentials and authentication material where authorised.
- Move laterally or pivot through the environment one stage at a time.
- Test relevant host or network security evasion techniques.
- Complete the defined objective and preserve sanitised evidence.
- Record failed approaches, troubleshooting steps and lessons learned.
- Map significant activity to relevant MITRE ATT&CK techniques where useful.
- Document defensive detection and remediation opportunities.
The emphasis is on repeatable methodology, clear reasoning and controlled exploitation. Finding the bug is useful; proving the impact safely is where the learning lands properly.
These notes may contain spoilers, command output, vulnerability details and complete attack or investigation paths. Anyone actively completing a room should attempt it independently before reading the associated writeup.
This repository will not intentionally publish:
- TryHackMe flags or answer strings;
- passwords or cracked credentials;
- reusable session tokens;
- private keys or sensitive certificates;
- certification examination content;
- copied room instructions or substantial portions of TryHackMe material;
- exploit material aimed at real-world unauthorised targets; or
- material that TryHackMe or a room author has asked learners not to share.
Note
Some values in this writeup have been intentionally redacted to protect the integrity of the challenge and prevent unintended spoilers. Placeholders such as <TARGET_IP> and <TUN0_IP> are used where IP addresses were required to explain the methodology without exposing environment-specific details. Other sensitive or challenge-revealing information has been replaced with <REDACTED>. Any flags have also been redacted, either as THM{...} for TryHackMe-style flags or as <REDACTED> where the flag format differs.
These redactions allow the process to be explained clearly while ensuring the final answer, challenge secrets, and key identifying details are not disclosed.
If restricted or sensitive information is included accidentally, please report it through the repository's GitHub Discussions area so it can be reviewed and removed.
These writeups are for educational purposes only and are based on authorised TryHackMe lab environments.
All tools, commands, techniques, and methodologies referenced in these writeups were used within controlled training environments where permission was provided by the owner and/or operator of the lab platform. The systems discussed are intentionally vulnerable machines designed for cybersecurity learning, practice, and assessment.
Do not use these techniques, tools, or methods against systems, networks, applications, or services that you do not own or do not have explicit written permission to test. Unauthorised access, scanning, exploitation, or disruption of systems is illegal and unethical.
The tools and methods listed in this repository are examples of approaches used during specific rooms or learning exercises. They are not the only possible solutions, and other tools, techniques, or workflows may be used depending on the target environment, room design, and individual methodology.
This repository is intended solely for authorised cybersecurity education, controlled laboratory exercises, Capture the Flag challenges, and legitimate defensive research.
Requests for assistance that appear to involve unauthorised access, real-world exploitation, credential theft, malware deployment, data theft, service disruption, evasion of security controls, or harm against individuals, organisations, systems, or networks will not be supported.
This includes, but is not limited to:
- Requests to attack systems without clear authorisation
- Attempts to obtain or misuse passwords, tokens, session cookies, API keys, or other credentials
- Requests involving ransomware, destructive malware, persistence, botnets, phishing, or data exfiltration
- Instructions intended to conceal malicious activity or evade detection
- Threats, harassment, extortion, doxxing, or targeted abuse
- Attempts to adapt educational material for use against real-world targets
Abusive or suspicious requests may be documented, preserved, blocked, and reported to the relevant platform, service provider, repository host, organisation, or lawful authority where appropriate.
By accessing or interacting with this repository, you agree to use its content only within environments that you own or are explicitly authorised to test.
Educational context does not excuse unlawful or harmful activity.
No authorisation means no testing.
TryHackMe periodically updates, replaces or retires rooms and learning paths. Links, room sequences and path content may therefore change after a writeup is published.
Each writeup should be treated as a record of the room as it appeared on the date documented. Where a material change is identified, the relevant page may be updated or marked as archived.
If you notice a broken link, outdated instruction, formatting problem, technical error or any other noticeable issue within a writeup, please report it through the GitHub repository's Discussions tab. When providing feedback, include the name of the affected writeup, a brief description of the problem and, where possible, the relevant section or line.
Constructive corrections are welcome and help keep the repository accurate, useful and maintainable.
Thanks for checking out my TryHackMe writeups. These notes form part of my ongoing cybersecurity learning journey, where I document rooms, techniques, tools, mistakes and lessons learned while working through different challenges.
You can view my TryHackMe profile here:
I am also active within cybersecurity learning communities, including Discord, where I discuss labs, tools, methodologies and general security topics with other learners and practitioners.
Feel free to follow my progress, compare approaches or get in touch if you are working through similar rooms.
Walkthrough requests are always welcome, although publication will depend on my availability and whether sharing the content complies with the platform's rules.
Created by V4L1K4HN as part of my cybersecurity learning journey through TryHackMe.
Unless otherwise stated, the original written content in this repository is licensed under the Creative Commons Attribution 4.0 International License.
Copyright © 2026 V4L1K4HN.
You may share and adapt the licensed material for any purpose, including commercially, provided that:
- appropriate credit is given to V4L1K4HN;
- a link to the license is provided; and
- any changes made to the original material are clearly indicated.
This license applies only to original material created by the repository author. TryHackMe content, branding, room materials, third-party software, trademarks, externally sourced material, and any other third-party intellectual property remain subject to their respective owners' terms and licenses.
See the LICENSE file for the complete legal terms.
Powered on ☕ made with ❤️ by V4L1K4HN
⭐ If this project is useful, consider starring it on GitHub.