TryHackMe Wrong Path — Building My First Boot2Root Room

Wrong Path is a little different from most of the TryHackMe rooms I’ve written about because I wasn’t solving someone else’s challenge.

I built this one.

It was my first attempt at creating a complete Boot2Root room for TryHackMe, and building a vulnerable machine turned out to be a very different experience from attacking one. When you’re solving a room, you’re looking for mistakes. When you’re building one, you’re deliberately creating those mistakes while trying to make sure the intended path is discoverable without making it obvious.

Wrong Path is built around a fictional HelpDesk environment and follows an attack chain involving enumeration, command injection, credential discovery, SSH access, and Linux privilege escalation.

I also intentionally included a few wrong turns.

That was one of the more interesting parts of designing the room. A realistic environment shouldn’t necessarily hand you the correct vulnerability every time you find something suspicious. Some files and clues are there to make you stop, investigate, and decide whether you’ve actually found something useful.

Building the Attack Path

The room begins with web enumeration and eventually exposes functionality vulnerable to command injection. From there, the player has to continue digging rather than simply getting a shell and calling the room finished.

The intended route eventually leads to a backed-up SSH key, offline password cracking, access to the HelpDesk account, and finally a Linux privilege-escalation path involving a privileged backup utility.

While building it, I spent a lot of time thinking about unintended shortcuts.

Could someone bypass an entire section of the room? Was a credential exposed somewhere I didn’t intend? Was the privilege-escalation path too obvious? Would someone actually find the clue that I expected them to find?

Those are questions I don’t normally have to think about while attacking a TryHackMe machine.

What I Learned From Building a TryHackMe Room

The biggest lesson was that creating a vulnerable system isn’t simply a matter of installing old software and opening a port.

You have to think about pacing, enumeration, difficulty, clues, permissions, services, unintended attack paths, and whether the environment still feels believable.

I also learned how differently you look at a machine when you already know every vulnerability inside it. Something that seems obvious to the person who built the room may not be obvious at all to somebody seeing it for the first time.

That experience alone made building Wrong Path worthwhile.

The room is available on TryHackMe:

Wrong Path has been submitted to TryHackMe for review. Once it is approved and made public, I’ll add the live room link here.

TryHackMe — Wrong Path

I’ve moved the complete step-by-step walkthrough, commands, and solution path to my GitHub TryHackMe repository.

Read the complete Wrong Path walkthrough on GitHub

RootNotebook will remain focused on the design of the room, the techniques involved, and what I learned from building it rather than reproducing the entire solution.