Cybersecurity Challenge Write-Ups

Platform: TryHackMe  |  Room: L2 MAC Flooding & ARP Spoofing

Introduction

For this write-up I chose the TryHackMe room "L2 MAC Flooding & ARP Spoofing". I picked this room because it taught me something practical about layer 2 attacks, especially the difference between passive sniffing, MAC flooding, and ARP spoofing. The room starts with simple enumeration and then gradually moves into man-in-the-middle traffic interception and packet manipulation.

Challenge Summary

In this room, the attacker first gains SSH access to a dual-homed Linux host called eve. From there, the internal network connected to eth1 can be explored. The room then moves through four main ideas:

• Discovering live hosts on the internal subnet.
• Passively sniffing traffic and understanding what can be seen without interfering with the network.
• Using MAC flooding to force a switch into a more hub-like behavior and expose additional traffic.
• Using ARP spoofing / ARP poisoning to become a man-in-the-middle and finally manipulating packets to obtain the final flag.

Environment and Tools Used

I completed the room from my Kali VM connected to the TryHackMe VPN. The main tools I used were:

• ssh — for access to the room machine
• sudo su - — to work as root when needed
• ip and nmap — for network discovery
• tcpdump — for packet capture and live sniffing
• Wireshark — for pcap analysis
• macof — for MAC flooding
• ettercap and etterfilter — for ARP spoofing and packet manipulation
• curl and netcat — for testing services and interacting with the target

Step-by-Step Solution

Task 1: Getting Started

The first task was just preparation. I started the room machine and made sure my Kali VM was connected to the TryHackMe VPN. I also waited a few minutes before connecting, because the room specifically mentions that the services may need time to start.

openvpn <your_tryhackme_config>.ovpn

Task 2: Initial Access

After the target IP appeared, I connected to the first machine by SSH using the credentials given in the room. Once I logged in as admin, I switched to root because the room itself suggests using the root user for the remaining steps.

ssh -o StrictHostKeyChecking=accept-new admin@10.128.176.177
sudo su -

At this point the task was simply to confirm that I could gain access. The correct answer for this step was that access was successful.

Task 3: Network Discovery

The next step was to inspect the second network interface, because the room states that the network of interest is connected to eth1. I first checked the interface configuration to find my internal IP address and subnet.

From this output I identified eve's internal address as 192.168.12.66/24. That immediately answered the first two questions: the IP address was 192.168.12.66 and the CIDR prefix was /24.

To discover the other hosts on the subnet, I used an Nmap ping scan. This showed three hosts in total: alice, bob, and eve.

nmap -sn 192.168.12.0/24

Task 4: Passive Network Sniffing

This task focused on passive sniffing — only listening on eth1 without changing any traffic.

I started by watching the traffic live using tcpdump:

tcpdump -i eth1

To get a more readable view of the payload, I also used the ASCII option. The useful part was the first line of each packet, which showed bob sending ICMP echo requests to eve and eve replying.

After that, I wrote the packets to a pcap file so I could inspect them in Wireshark more comfortably:

tcpdump -i eth1 -w /tmp/tcpdump.pcap

Task 5: Sniffing While MAC Flooding

The next idea was to increase the amount of visible traffic by using MAC flooding. The theory is that if the switch's MAC table becomes overloaded, it may temporarily act more like a hub and forward extra frames to other ports. I used two SSH sessions: one to capture, one to flood.

First SSH session:

tcpdump -i eth1 -w /tmp/tcpdump2b.pcap

Second SSH session:

macof -i eth1

After around one minute I stopped both, copied the capture back to Kali, and opened it in Wireshark:

scp admin@10.128.176.177:/tmp/tcpdump2b.pcap .
wireshark tcpdump2b.pcap

I could now see additional ICMP traffic between Alice and Bob. The correct packet type was ICMP and the data size was 1337 bytes. This task also taught me that MAC flooding is noisy, unreliable, and not something a real attacker would prefer if a quieter method is available.

Task 6: Man-In-The-Middle: Intro to ARP Spoofing

Since MAC flooding is noisy, the room moved to ARP spoofing. The idea was to poison the ARP caches of Alice and Bob and place eve in the middle of their communication.

ettercap -T -i eth1 -M arp

In this first scenario, the hosts were using ARP validation, so ettercap could not establish a proper MITM. The answer to whether MITM could be established was therefore Nay.

Task 7: Man-In-The-Middle: Sniffing

Task 7 introduced a new machine with Alice and Bob running Ubuntu with default ARP behavior, making a successful ARP spoofing attack realistic.

ssh -o StrictHostKeyChecking=accept-new admin@10.129.153.233
sudo su -
ip a s eth1
nmap -sn 192.168.12.0/24

I then scanned both systems for open services:

nmap -sV 192.168.12.10 192.168.12.20

Alice had 4444/tcp open, Bob had 80/tcp open. I tested direct access to Bob's web service:

curl http://192.168.12.20

The server replied with "no auth header received" — the service was reachable but protected.

I then launched ARP spoofing with ettercap and monitored HTTP traffic in a second terminal:

First SSH session:

ettercap -T -i eth1 -M arp

Second SSH session:

tcpdump -i eth1 -A port 80

This time the attack worked. I could see Alice sending HTTP requests to Bob through eve. The request showed the Host header was www.server.bob, the requested file was /test.txt, and the HTTP response body contained OK. I also spotted a Basic Authorization header which decoded to admin:s3cr3t_P4zz.

Using those credentials I was able to retrieve the first flag:

curl -u admin:s3cr3t_P4zz -H "Host: www.server.bob" http://192.168.12.20/user.txt

Flag: THM{wh0s_$n!ff1ng_0ur_cr3ds}

I also observed Bob connecting back to Alice on port 4444, revealing a reverse shell. By watching the stream I saw the commands executed in order: whoami, pwd, and ls. The file of interest was root.txt.

When stopping ettercap with q, the tool gracefully re-ARPed the victims to restore the ARP state.

Task 8: Man-In-The-Middle: Manipulation

The final task moved from passive interception to active packet manipulation. I created an etterfilter source file (whoami.ecf) to replace Alice's whoami command with a reverse shell payload, then compiled it:

etterfilter whoami.ecf -o whoami.ef

I disabled ufw to ensure the incoming reverse shell would not be blocked:

I started a Netcat listener on port 6666, then launched ettercap with the compiled filter:

ettercap -T -i eth1 -M arp /192.168.12.10// /192.168.12.20// -F whoami.ef

The filter worked. Alice's whoami command was replaced by my reverse shell payload, and Bob connected back to my Netcat listener. I had remote shell access as root and found the final flag:

Flag: THM{wh4t_an_ev1l_M!tM_u_R}

What Failed and How I Corrected It

• My Kali VM lost internet access at one point — I had to fix the VMware/NAT setup and restart services on my host before continuing.
• I mistyped eht1 instead of eth1 and forgot the -w option on some tcpdump commands, causing errors until I corrected them.
• When copying pcap files with scp, I first ran the command in the wrong session and had to correct the direction of the file copy.
• In Task 7, I initially wrote down the decoded credentials incorrectly. After inspecting the Authorization: Basic header more carefully, I got the right username and password.
• In Task 8, I mistakenly left the placeholder <reverse_shell> in the filter file instead of replacing it with an actual payload.
• I also initially confused the etterfilter source file (.ecf) with the compiled file (.ef). Ettercap requires the compiled version produced by etterfilter.

What I Learned

• Passive sniffing on a switched network only shows traffic already destined for my interface.
• MAC flooding can expose more traffic but is noisy and unreliable.
• ARP spoofing is a much more practical MITM approach when hosts do not validate ARP replies.
• Packet captures are more useful when you understand exactly which field you are looking at.
• MITM attacks are not only about listening — with the right tool they can also manipulate live network traffic.

Conclusion

Overall, I found this room very useful because it connected networking theory to practical attack behavior. I started by identifying hosts on an internal subnet, then moved to passive analysis, MAC flooding, ARP spoofing, and finally packet manipulation. The room clearly showed the difference between a network where traffic is merely visible and one where the attacker can actively interfere with what two hosts send to each other.

The challenge also reinforced a good lesson as a beginner: solving labs is rarely just about one perfect command. A lot of the work comes from observing outputs carefully, correcting small mistakes, comparing approaches, and understanding why one method fails while another succeeds.

Platform: TryHackMe  |  Room: Investigating Windows (Blue Teaming)

Introduction

This challenge involves investigating a Windows machine to determine signs of compromise. The goal is to analyze system information, user activity, scheduled tasks, logs, and to identify what the attacker did.

Q1: What's the version and year of the Windows machine?

This one is straightforward.

I checked System Information on the machine and saw that the operating system is Windows Server 2016.

"You could also just run systeminfo in PowerShell"

Answer: Windows Server 2016

Q2: Which user logged in last?

To figure this out, I used PowerShell.

First, I ran:

Get-LocalUser

This shows all local users on the system.

Next, I checked the last logon times:

Get-LocalUser | Select Name, LastLogon

From this I could see the last logon activity for each user. The only two users that had logged on were Administrator (from me connecting) and john.

Answer: Administrator

Q3: When did John log onto the system last?

Looking at the output from the last command we know the answer.

Answer: 03/02/2019 5:48:32 PM

Q4: What IP does the system connect to when it first starts?

I noticed this IP during boot, but the correct way to verify it is through the Windows Registry.

HKEY_LOCAL_MACHINE
→ SOFTWARE
→ Microsoft
→ Windows
→ CurrentVersion
→ Run

The Run key shows programs that execute when Windows starts. The most suspicious of the three entries is the launching of p.exe located in the TMP folder, which is launched with -s meaning "Silent".

Answer: 10.34.2.3

Q5: What two accounts had administrative privileges (other than Administrator)?

To find this I opened:

Computer Management → Local Users and Groups → Groups → Administrators

"Or if you want to use a command, Get-LocalGroupMember -Group "Administrators""

This shows all users with administrator privileges on the machine. Besides the built-in Administrator, the two additional accounts were:

Answer:

• Guest
• Jenny

Q6–Q8: Malicious Scheduled Task

• What's the name of the malicious scheduled task?
• What file was the task trying to run daily?
• What port did this file listen on?

To investigate this, I opened Task Scheduler.

"Alternatively, I could've used Get-ScheduledTask, but it would be less readable for me."

There were several scheduled tasks, most of them created by the Administrator. I checked each task's Actions tab to see what program it executed. One task stood out: "Clean file system"

This task runs a script called:

nc.ps1

After looking it up, I learned that Netcat is a networking utility commonly used for reading and writing data across network connections. Attackers often use it to create backdoors and remote shells. The .ps1 extension indicates that it is a PowerShell script. The script was configured with the -l flag, meaning it was listening for incoming connections, and it was set to listen on port 1348.

Answers:

• Task name: Clean file system
• File executed: nc.ps1
• Port used: 1348

Q9: When did Jenny last log on?

To get more details about the user account I used:

net user Jenny

This command shows detailed information about the account including the last logon time.

Answer: Never

Q10: At what date did the compromise take place?

I returned to Task Scheduler to look for suspicious activity.

One task named flashupdate22 had a creation date of 03/02/2019.

This date also matches:

• John's last login
• Jenny's password change

Because several suspicious events occurred on the same date, it strongly suggests that this is when the compromise happened.

Answer: 03/02/2019

Q11: During the compromise, at what time did Windows first assign special privileges to a new logon?

This one took a bit more time.

My first attempt was searching PowerShell help commands (Get-Help) to see if there was a way to check privilege assignments directly, but I couldn't find anything useful. After doing some research I learned that these events are stored in Event Viewer.

I opened:

Event Viewer → Windows Logs → Security

Then I searched for the event ID related to privilege assignment.

Event ID 4672 — Special privileges assigned to new logon

At first all my logs only showed entries from the current day, which confused me. After spending some time troubleshooting, I took a hint and realized that something technical must have gone wrong. So, I restarted the VM. Once the machine rebooted, the older logs from 2019 appeared allowing me to filter by event ID and time. Filtering for Event ID 4672 on 03/02/2019 gave the result:

Answer: 03/02/2019 4:04:49 PM

Q12: What tool was used to get Windows passwords?

Earlier we saw that the scheduled task executed nc.ps1, so I checked again where that file was stored. (The TMP folder)

Inside this folder there were several files that appeared to belong to the attacker. After looking through them, I found a text file named:

mim-out

Mimikatz — after a quick Google search, I understood that it is an open source tool created by Benjamin Delpy that extracts credentials from Windows memory (LSASS), including passwords and hashes.

Answer: Mimikatz

Q13: What was the attacker's external command and control server IP?

The biggest tell for this one was the mention of DNS poisoning for the last question. My first thought was to check the hosts file.

I opened it with:

notepad C:\Windows\System32\drivers\etc\hosts

The hosts file can override DNS entries by mapping domain names to specific IP addresses. From here I employed a bit of brute forcing, by checking whether these IPs matched, until I saw that the one for Google does not match.

Answer: 76.32.97.132

Q14: What was the extension name of the shell uploaded via the server's website?

To investigate this, I checked the web server directory:

C:\inetpub\wwwroot

Inside this folder there were two files with the extension .jsp. JSP stands for Jakarta Server Pages, which are used by web servers to generate dynamic content.

Answer: .jsp

Q15: What was the last port the attacker opened?

The hint suggested looking at the firewall.

I opened:

Windows Defender Firewall → Advanced Settings → Inbound Rules

Inbound rules control incoming network connections. While looking through the rules, I noticed one that didn't exist on my own system and appeared suspicious. The rule opened port 1337.

Answer: 1337

Q16: Check for DNS poisoning — what site was targeted?

Earlier when we checked the hosts file, we saw that the domain google was redirected to the attacker's IP address. This confirms that the DNS poisoning targeted Google.

Answer: google.com

Platform: TryHackMe  |  Room: Disk Analysis & Autopsy

Introduction

I chose this challenge because of a name which tells me that it can be something very interesting, because it's not about trying to come in environment, but what to do if you already there.

I'm thinking about this as ethical hacker using as a reference quote: “To understand what I need to protect I need to understand what is vulnerable”.

Challenge Summary

I find it difficult because this is the second part of challenge, I spotted it by the sentence(because of which for me, it was impossible to solve it without Google certain things):

“This room should help to reinforce what you learned in the Autopsy room. Have fun investigating!”

But when I tried to investigate I noticed that this is a premium room and I need to pay for it.

So, this room which I took assume that I already have some basic knowledge about Autopsy, which I don’t. So I would do it anyway as a real problem solver.

New case, for now nothing weird. I just open the folder from a desktop.

I get an error.

So, image is missing, and I need to find them. Gladly, assignment provide me with hint about that part:

In the same window which was emerged after error I paste the same path and now im getting somewhere:

Inside this disk I have partitions, nice:

Step-by-Step Solution

First question was “What is the MD5 hash of the E01 image?” for this I struggled a little, but I think that this information contains inside a description, somewhere.

Using right-click on a disk I see a Properties link. So I would start with this first.

Nothing here reminds me actual MD5 string, so I would move further. Next link I follow was about Data Sourse Summary:

I would now investigate each page to find this MD5

I already saw Types, nothing which looks like MD5 are there, move on All the Mentioned pages was empty, or contains not what I need. But last one had saved me.

Hoooray, first question solved. Answer is 3f08c518adb3b5c1359849657a9b2079

Second question is “What is the computer account name?”

At first, I thought its HASAN, as well as the name of a user, but I was wrong.

So I went to the left bar and spotted page “Operating System Information”, which, when I investigate give me a name of a computer.

Second question was solved. Answer is DESKTOP-0R59DJ3

Third question was about “List all the user accounts.(alphabetical order)”

For that I used “Operating System User Account” thread

With following information:

So now I can see all of a Usernames. Question is solved, I just need to sort them in alphabetical order. Answer is H4S4N,joshwa,keshav,sandhya,shreya,sivapriya,srini,suba

Fourth question was about “Who was the last user to log into the computer?”

I found it on a same page as before:

Question is solved, answer is sivapriya

Fifth question was “What was the IP address of the computer?”

To solve this I was investigated all web threads, maybe something was there.

All of them was empty, so now im thinking, that it can be inside a previous tabs, but they were not helpful either.

Next idee was to investigate /etc/host inside System32, because if there is any ssh connections maybe they add it to that file.

But nothing was there, so I had no other choice rather than to google this. As a result I did found a forum: link with following information:

This was EXACTLY what I needed, absolute cinema(nope). But I do notice that they mentioned reqistry files, so when I later went to see how to look up for this kind of files inside Autopsy properly, I found this:

So my next thought was to look up inside System32/Config, maybe I can find it there. But for this I should find correct partition first.

How happy I was to discover that 3 out of 6 partitions is unallocated, and 1 more is unknown, which reduces mu scope of search. So my second attempt was successful.

I find the main partition with Program Files, Users, and Windows itself.

So I investigate that folder And Choose SECURITY reg file because no other file there had interesting name for me, but I had been opened all threads from there and found nothing,

I took a look inside Software regfile as well, but have found nothing. More than that, we don't have hint on tryhackme either…

I decided to take a step back and looking for something else, maybe I have some applications installed, which are working with network, like for instance, wireshark.

And I did found something… very interesting.

I would try to found something about this application inside program files folder

I found a file with a name hostlist. Thought that something must be inside, but its empty.

From now, I was just clicking on everything in hope to get something… and I did:

What a luck. Question is solved, Answer is 192.168.130.216

Next question was “What was the MAC address of the computer?”

I thought that it need to be written together with ip, but I don't found it inside a file.

So I have a look at everything which I tried for IP and failed. Actually I was struggling with this a lot, so I get to google, to find out how look@LAN can work. Maybe it has captured MAC, but I don't see it. And I was right.

I took small help from artificial intelligence here, and get

Wow… It was all that time under my nose… But wait! WHAT?!

I don’t get it but maybe I too poor for that information.

Question is solved, Answer is 08-00-27-2c-c4-b9

Next question was “What is the name of the network card on this computer?”

For that I remember that I saw it somewhere inside System32 already, so I need go move back for a while. Folder config was my first idee. Nothing inside SECURITY and SOFTWARE folders, so I google for it.

Question is solved, Answer is Intel(R) PRO/1000 MT Desktop Adapter

Next question was “What is the name of the network monitoring tool?”

I saw it already, Question is solved, Answer is Look@LAN

Next question was “A user bookmarked a Google Maps location. What are the coordinates of the location?”

I think that I should come back to web threads again.

This one looks familiar…

Gotcha!

Question is solved, Answer is 12°52'23.0"N 80°13'25.0"E

Next question was “A user has his full name printed on his desktop wallpaper. What is the user's full name?”

At first, I discovered Users/Public folder inside partition with Windows.

I check every user and each of them has this:

Which is very weird itself, so I investigate inside H4S4N little bit more but found nothing.

Actually I'm thinking that he can have something inside downloads folder, maybe. Nothing interesting, 0 metadata, so I'm thinking to look to every user downloads folder, maybe it would work instead.

joshwa has name on a picture, maybe I need to try it for a sake of luck.

Question is solved, Answer is Anto Joshwa

Next question was “A user had a file on her desktop. It had a flag, but she changed the flag using PowerShell. What was the first flag?”

And this would be an easy one because during my previous investigation I already had founded some weird powershell script. It was on Shreya Desktop.

Maybe answer is I-hacked-you. wrong. I have one more txt file there, Maybe it is the right answer.

It isn’t working as well. Maybe powershell history would give me hint. But I don’t know how to get it.

Question is solved, Answer is flag{HarleyQuinnForQueen}

Next question was “The same user found an exploit to escalate privileges on the computer. What was the message to the device owner?”

I think that I saw it already then inside powershell script.

Question is solved, Answer is flag{I-hacked-you}

Next question was “2 hack tools focused on passwords were found in the system. What are the names of these tools? (alphabetical order)”

There are only one thing that can help me, it's antiviruses.

I had looked into installed programs and didn’t find any.

So there is only one place left where Windows can store information about possible vulnerabilities, its Microsoft Defender logs. But I need to google of how can I find it, probably inside system32.

Seems good.

Actually I found 4 but hint to a question sad that I need to remove .exe, so I assume that mimidrv.sys is not correct. Others are repeat themselfes, so I think that that’s all. And I was right.

Question is solved, Answer is lazagne, mimikatz

Next question was “There is a YARA file on the computer. Inspect the file. What is the name of the author?”

At first, I need to discover what is yara file

I don’t have etc folder even though he is as always was in system 32, so it cannot help me. Maybe it would be faster to find this file by extension.

It didn’t work, so I took myself to google once again

link

Of course I would

Question is solved, Answer is Benjamin DELPY (gentilkiwi)

Next question was “One of the users wanted to exploit a domain controller with an MS-NRPC based exploit. What is the filename of the archive that you found? (include the spaces in your answer)”

I don’t know what is this, so I need to research again:

Why I haven`t found this tool before…

Actually In sure that this tool was mentioned at the first part of a challenge which is not free and available only through premium subscription, but whatever, I know it already anyway(But I think that I would but it in a future anyway because I found there challenge about macOS investigation, which is very interesting for me as for Mac user)

While I was typing it tool is find some results already, I would try them.

Wrong, but when I was looking inside assignment I noticed that the file must be archived. So I'm thinking that this 2 file are unarchived version, which means that I need just to change extension for answer.

Question is solved, Answer is 2.2.0 20200918 Zerologon encrypted.zip

It was very interesting to solve, I definitely would download this tool to my host because it's really cool! And now I know how to use it in case if I need to.