An honest review of TryHackMe's PT1 entry-level penetration testing certification. Covers real-world Web exploitation, Network pentesting, and Active Directory attacks. A solid OSCP preparation path for those starting out in offensive security.

Medium-rated Windows box. A CSRF vulnerability and blind XSS in a note-sharing app steal admin credentials. SMB write access plants an ASPX webshell for RCE. WSL bash history leaks administrator credentials for full system access.

Easy-rated Linux box. A Flask/Jinja2 SSTI vulnerability in a virtual-host medical web app achieves RCE. Audit log analysis reveals credentials for a user in the adm group. SplunkWhisperer2 exploits a Splunk universal forwarder for privilege escalation to root.

Easy-rated Linux box. FTP and robots.txt expose backup archives with leaked credentials. Adminer 4.6.2 is exploited via CVE-2021-43008 for arbitrary file reads from the database server. A sudo rule with SETENV enables Python library hijacking via PYTHONPATH to escalate to root.

Medium-rated Windows Active Directory box. LDAP null-bind enumeration uncovers a VNC password stored in a user attribute. A .NET assembly is reverse-engineered with ILSpy to recover an AES decryption key, and a deleted AD Recycle Bin account's password grants administrator access.

Medium-rated Linux box. A NoSQL injection in a MongoDB-backed login form extracts credentials character by character via regex blind injection. SSH access pivots to another user whose GTFOBins jjs Java binary escalates to root.

Medium-rated Linux box. SQL injection bypasses authentication on an image upload portal. A magic-bytes polyglot bypasses file type validation to achieve RCE. A SUID binary with a relative command path is hijacked via PATH manipulation for privilege escalation.

Medium-rated Windows Active Directory box. LDAP null-bind enumeration and a username-as-password spray gain initial access via SMB. A plaintext password in an Azure AD Connect configuration file enables credential dumping for domain administrator access.

Hard-rated Windows Active Directory box. A KeePassXC database cracked from FTP yields MSSQL credentials. RID bruting and password spraying gain a foothold. BloodHound maps a constrained delegation chain, and SeEnableDelegationPrivilege enables DCSync to complete domain compromise.

Medium-rated Windows Active Directory box. NFS exposes files leading to a password-sprayed foothold. PetitPotam coerces DC authentication to a relay server, exploiting ADCS ESC8 to issue a certificate for DCSync and full domain compromise.