Welcome to the world of TryHackMe, where cybersecurity education meets creativity! Building your own room on TryHackMe is a fantastic way to share your knowledge and engage with the community. In this guide, we'll walk you through the essential steps to plan, build, and submit your very own room.

Whether you're a seasoned professional or just starting, creating a TryHackMe room is a rewarding experience. Let's get started on this journey of knowledge-sharing and exploration.
​

If you’re looking to break into the industry, having a “portfolio” or list of personal projects is recommended by employers. It demonstrates your motivation, your interest, and your growing knowledge.

Building a room for TryHackMe users takes time and skill - it’s a perfect way to signal your mastery of foundational concepts.

You’ll also get great feedback from a supportive community who love challenge rooms.

In the planning phase, creators often draw inspiration from real-life incidents encountered during their cybersecurity journeys. Using my room, "Hijack", as an example, the initial spark came from intriguing scenarios and misconfigurations observed in the wild. These real-world incidents serve as the foundation for educating others and sharing valuable knowledge.
​

After formulating the core concept for our room, the next step involves outlining key components to shape the room's structure. For instance:

Foothold:

Once the key components for the room structure are defined, we can expand on each of these elements. For instance:

With these key points and expanded details, the planning phase sets the structure for the room. Creators have a clear outline of the foothold, pivoting, and privilege escalation steps, making the subsequent building process more straightforward. The detailed planning ensures a comprehensive and well-thought-out learning experience for participants engaging with the room.

With a well-defined structure established, we can start building. Staying consistent with our previous example, let's walk through the construction of the "Hijack" machine.

Before we start, we want to point out that you have the option to install VirtualBox and a Linux ISO image instead of using Vagrant. If you prefer this method, you can skip directly to Customizing Your Machine. However, we'll primarily focus on using Vagrant for building the room. Vagrant offers several advantages, including easy setup, reproducibility, and consistency across different environments. Additionally, Vagrant simplifies the process of sharing and distributing virtual machines, making it an ideal choice for creating rooms on TryHackMe.

To start, we'll install Vagrant and VirtualBox, the key software for building the virtual machine. The installation of these tools is straightforward. Simply execute the following command:

After completing the installation, we proceed by creating a directory to store our machine's data:

Within this directory, we create two additional directories named box and data:

Next, we navigate into the box directory, where we will generate the configuration file.

Before creating the file, we must select the Vagrant box we want to use. You can choose from available boxes here. For this tutorial, we will use the ubuntu/xenial64 box:

Once the box is chosen, we go into the box directory created earlier and run:

With that, our configuration file is created:

Before starting the machine, we need to go into that configuration file and customize it a little bit. Scrolling down, we need to un-comment these highlighted lines:

The first line will assign an IP address to our virtual machine, allowing us to access it in our local network. The second one will mount the previously created data directory on the machine for ease of access.

After completing these steps, we are ready to start our machine. Simply run:

Now, our virtual machine is up and running. To access it via SSH, execute:

And there you have it, an interactive shell with our virtual machine!

Now comes the interesting part, the phase where we start customizing the virtual machine to align with the structure set during the planning phase. It's our responsibility to install all the tools and software needed to run various applications and services, marking the start of your trial and error journey.

Disclaimer: From this point onward, feel free to follow your own path. Each machine is unique and requires a distinct building approach. We'll continue with our example, the "Hijack" room, but you can extract concepts to start with your machine.

To initiate this process, we return to the data directory created earlier on our local machine and create the bash setup script responsible for building and customizing our machine. Although manual installation is an option, using a script is more efficient.

If we navigate back to our virtual machine, we'll observe that the file is also created in /vagrant_data, which is the mounted directory set up earlier in the Vagrant configuration:

The first command that we'll add to the setup script is sudo apt update command to update the repositories.

Next, we need to change the password of the root user. This will ensure that we have complete control over our machine if needed, using this command:

Now, we need to install the necessary packages to be able to run the services mentioned in the planning phase. After adding those, our setup.sh file will look like this:

After the installation, we need to configure some of the services, starting with the NFS share.

As planned, we aim to create a misconfigured NFS share vulnerable to user impersonation. After thorough research, we arrived at these commands:

We append these to the setup.sh file and add the for_employees.txt file containing FTP credentials in the data directory before moving on to configure FTP.

After further research and trial and error, we finalized these commands for FTP setup:

These commands configure the FTP server, create the FTP user, and manage permissions for the root directory of the FTP server. Then adds the files relevant to the challenge to the server. We add these commands to the setup script and move on.

Now we need to set up the web application. After developing and testing the app, we place the source code in the data directory and add these commands to our setup:

These commands copy the source code of our app and place it in the default root directory of the web, which is in /var/www/html/ , and then set up the database.

Now that we are done setting up the services and apps, it's time to create the user rick using these commands:

Notice that we made a copy of the /etc/sudoers file and placed it in the data directory with slight modifications, allowing the user rick to run the /usr/sbin/apache2 -f /etc/apache2/apache2.conf -d /etc/apache2command as root and adding the env_keep+=LD_LIBRARY_PATH entry for the privilege escalation part.

We do the same for SSH. We grab a copy of the /etc/ssh/sshd_config file, make appropriate changes to it, save it in the data file, and we add these lines to the setup script:

We are done with the base tasks; what's left now is cleaning the machine and adding the flags. First, we remove all the history files and redirect them to /dev/null using symlinks:

Next, we add the flags:

Now we need to patch the machine and secure it from any famous exploits. Looking at the version of this machine, we only need to remove SUID from the psexec binary and uninstall lxc:

Finally, we remove the users created by vagrant:

With that, our setup script is complete.

Now, we move to our created virtual machine and run the setup script as the root user:

Let the setup run. Once it finishes, we un-mount the /vagrant and /vagrant_data directories, then delete them:

Now our machine is ready!

Before shutting it down, we want to ensure that the machine runs properly. First, we scan our machine with nmap to check if all the intended ports are open:

Next, we quickly visit the web application to check if it's running properly:

Everything runs great. Now we are ready to shut down the machine.

We open a new terminal tab, then navigate to that box directory, and run:

The machine is now shutdown, and the building phase is complete.

Now, we need to export the virtual machine into an ova format to be able to upload it to TryHackMe. To do that, we first open VirtualBox.

Note: Open VirtualBox as root

We can see our virtual machine. To export it, we go to the upper-left corner and click on File, then Export Appliance:

Then a new window pops up:

We select our virtual machine and click Next:

Here, we specify the path where our exported machine will be saved, and leave all other settings on default, and click Next:

Now, we just click Export, and the operation starts.

After the export finishes, we get our ova file that we will upload to TryHackMe:

Please look at these articles on the room creation process.

With that, our submission is complete!

Now, the TryHackMe staff will carefully review our room and evaluate it. If the room meets their standards, they will proceed with testing. Otherwise, they will provide us with suggestions on how to improve the room. The TryHackMe Quality Assurance (QA) team is incredibly supportive during this process, offering helpful feedback and guidance to ensure that our room is both engaging and educational. Their expertise and assistance play a crucial role in refining and enhancing the quality of our room before it's released to the TryHackMe community.

The community's support during and after the room submission was invaluable. It was evident through the congratulatory messages, positive feedback, and expressed interest in room creation. Many community members showed enthusiasm and appreciation for the content created. Additionally, some individuals approached with collaboration proposals for room creation, showcasing a desire for collective contribution and knowledge sharing. Overall, the community's engagement and encouragement significantly contributed to the motivation to continue creating and enhancing rooms on TryHackMe.

In conclusion, creating and submitting a room on TryHackMe is a rewarding experience that offers numerous benefits. From honing technical skills to fostering collaboration within the cybersecurity community, the process of planning, building, and submitting a room provides valuable opportunities for growth and learning. The supportive environment provided by TryHackMe and its vibrant community ensures that creators receive constructive feedback and encouragement every step of the way. Whether you're a seasoned cybersecurity professional or a novice enthusiast, creating a room on TryHackMe is an excellent way to contribute to the community while expanding your knowledge and skill set. So why wait? Start planning your room today and dive into an exciting journey of exploration and education with TryHackMe.
​