🔵 TryHackMe — Blue | Windows Exploitation Learning Guide
Platform: TryHackMe Room: Blue Path: Cyber Security 101 → Exploitation Basics Estimated Time: 30 Minutes Status: Completed ✅
Spoiler-Free Learning Guide: This article contains no TryHackMe flags, cracked passwords, task-specific module paths, vulnerability-answer submissions, or lab-specific values. It focuses on the methodology, tools, concepts, and safe command patterns I practiced while completing the room.
Introduction
After learning Windows fundamentals, command-line basics, networking, and defensive tools, I moved on to a more practical exploitation room:
Blue
The Blue room introduces a complete beginner-friendly Windows exploitation workflow.
Instead of only reading about vulnerabilities, the room takes us through several stages:
Reconnaissance
↓
Identify Vulnerability
↓
Gain Initial Access
↓
Upgrade the Shell
↓
Verify Privileges
↓
Credential Dumping
↓
Password Cracking
↓
Post-Exploitation Enumeration
TryHackMe describes Blue as an educational beginner room where we scan a Windows machine, identify a known vulnerability, gain access with Metasploit, work with Meterpreter, dump password hashes, and locate important files on the target. (TryHackMe)
The room is divided into five tasks:
Task 1 — Recon
Task 2 — Gain Access
Task 3 — Escalate
Task 4 — Cracking
Task 5 — Find Flags!
Task 1 — Recon
The first stage of almost any penetration test is:
Reconnaissance
Before attempting exploitation, we need to understand the target.
Questions I want to answer include:
Is the machine reachable?
Which ports are open?
Which services are running?
What operating system appears to be running?
Are any exposed services outdated or vulnerable?
This is where Nmap becomes useful.
The Blue room begins by asking us to scan the deployed Windows machine and determine which exposed service might lead to exploitation. TryHackMe also notes that the target may not respond to ICMP, which is a useful reminder that failed ping responses do not necessarily mean the host is offline. (TryHackMe)
Port Scanning
A simple scan against an authorized lab target could look like:
nmap <TARGET_IP>
A more useful enumeration scan is:
nmap -sC -sV <TARGET_IP>
Here:
-sC → Run default Nmap scripts
-sV → Detect service versions
Instead of seeing only:
Port open
we can obtain more context about the service behind that port.
Why Service Enumeration Matters
Imagine a scan returns:
PORT STATE SERVICE
--------------------------------
XXX/tcp open service-A
YYY/tcp open service-B
ZZZ/tcp open service-C
My next question should not immediately be:
Which exploit should I run?
A better process is:
Open Port
↓
Identify Service
↓
Determine Version / Protocol
↓
Research Known Vulnerabilities
↓
Validate Applicability
This prevents randomly launching exploits against services we do not understand.
SMB as an Attack Surface
One of the important technologies encountered in this room is SMB.
SMB stands for:
Server Message Block
Windows commonly uses SMB for capabilities such as:
File sharing
Printer sharing
Network resource access
Windows communication
Older SMB implementations have historically contained serious vulnerabilities.
The important lesson here was:
An exposed service is not automatically vulnerable, but its protocol, version, patch level, and configuration can reveal possible attack paths.
Vulnerability Research Workflow
Once I identify an interesting service, I can research it using:
Service name
Version
Operating system
Microsoft security bulletins
CVE databases
Metasploit modules
Nmap vulnerability scripts
A useful Metasploit search pattern is:
search <technology-or-vulnerability>
And Nmap can also run scripts targeted at specific protocols:
nmap --script "<relevant-script-pattern>" -p <PORT> <TARGET_IP>
I am intentionally not including the exact vulnerability identifier requested by the Blue room.
🛠️ Hands-On / Commands — Task 1
Tools Used
Nmap
TryHackMe AttackBox
Windows target VM
Service enumeration
Vulnerability research
Commands I practiced:
nmap <TARGET_IP>
nmap -sC -sV <TARGET_IP>
For more detailed service discovery:
nmap -sV -p <INTERESTING_PORT> <TARGET_IP>
My reconnaissance workflow became:
SCAN
↓
PORTS
↓
SERVICES
↓
VERSIONS
↓
VULNERABILITY RESEARCH
↓
VALIDATE
No room-specific port count or vulnerability-answer string is included here.
Task 2 — Gain Access
After identifying a potentially exploitable service, the next objective is:
Initial Access
The room uses:
Metasploit Framework
to demonstrate exploitation.
Metasploit provides modules for:
Reconnaissance
Scanning
Exploitation
Payload delivery
Post-exploitation
Session management
The Blue room explicitly guides learners through starting Metasploit, locating the appropriate exploitation module, configuring its required options, selecting a reverse-shell payload, and running it against the lab target. (TryHackMe)
Understanding Metasploit's Workflow
The process can be summarized as:
Start Metasploit
↓
Search for relevant module
↓
Select module
↓
Show options
↓
Configure target
↓
Configure payload
↓
Validate settings
↓
Run
↓
Receive session
Starting Metasploit
msfconsole
The prompt changes to something similar to:
msf6 >
From here I can search available modules.
Searching Modules
Generic syntax:
search <keyword>
For example:
search windows smb
The search results may contain:
auxiliary modules
exploit modules
post-exploitation modules
payloads
The important skill is identifying the difference between them.
Selecting a Module
The general syntax is:
use <MODULE_PATH>
I am intentionally not publishing the exact Blue module path because finding it is one of the room's tasks.
Reading Module Options
After selecting a module:
show options
This tells us which values are:
Required
Optional
Already configured
Missing
Common Metasploit parameters include concepts such as:
Remote host
Remote port
Local callback address
Local callback port
Payload
RHOST vs LHOST
This distinction is extremely important.
RHOST
=
Remote Host
=
Target machine
while:
LHOST
=
Local Host
=
Our attacking/listening machine
Conceptually:
Attacker Target
LHOST RHOST
| |
| <------ Reverse Shell ---------|
Mixing these values up is a common reason reverse shells fail.
Payloads
An exploit and a payload are different things.
Exploit
↓
Takes advantage of vulnerability
while:
Payload
↓
Code executed after exploitation succeeds
A reverse-shell payload causes the compromised machine to connect back to the attacker's listener.
Target
|
| Reverse connection
v
Attacker
Backgrounding a Session
After receiving a shell, Metasploit allows sessions to be moved into the background so we can continue using the framework.
Conceptually:
Active shell
↓
Background
↓
Metasploit console
↓
Use post-exploitation module
Session management becomes very important in the next task.
🛠️ Hands-On / Commands — Task 2
Tools Used
Metasploit Framework
Reverse shell
Session management
Windows command shell
General workflow:
msfconsole
Inside Metasploit:
search <KEYWORD>
use <MODULE_PATH>
show options
set <REQUIRED_OPTION> <VALUE>
set payload <PAYLOAD>
run
or:
exploit
I deliberately excluded the exact exploit path and required task-answer value.
Task 3 — Escalate
This task teaches an important Metasploit concept:
Upgrading a Basic Shell to Meterpreter
A normal Windows shell may look like:
C:\Windows\system32>
It provides standard Windows commands.
Meterpreter provides a richer post-exploitation interface with functionality such as:
Process enumeration
Privilege inspection
File navigation
Credential collection
Session migration
System information
Shell spawning
The room guides learners through backgrounding the existing shell, using a post-exploitation module to upgrade the session, verifying the privilege level, listing processes, and migrating into another process. (TryHackMe)
Shell vs Meterpreter
A useful comparison is:
| Normal Shell | Meterpreter |
|---|---|
| Windows commands | Metasploit post-exploitation commands |
| Basic interaction | Rich session functionality |
whoami |
getuid |
| Native commands | Process migration, credential tools, etc. |
Sessions
Metasploit may maintain multiple active connections.
To view them:
sessions
or:
sessions -l
Conceptually:
Session 1 → Basic shell
Session 2 → Meterpreter
Session 3 → Another target
I need to know which session I am working with before launching post-exploitation modules.
Checking Identity
In a Windows shell:
whoami
In Meterpreter:
getuid
These commands answer:
Which security context am I currently running under?
This is one of the first checks I should perform after gaining access.
Why Privilege Level Matters
Windows permissions determine what actions the session can perform.
A low-privilege user may not be able to:
Read sensitive system files
Dump credential material
Modify protected resources
Access other users' data
A highly privileged security context has substantially more access.
Process Enumeration
Meterpreter can list processes:
ps
The process list helps identify:
PID
Process name
Architecture
User/security context
Process Migration
Meterpreter can sometimes migrate its execution into another process.
Generic syntax:
migrate <PID>
Conceptually:
Meterpreter
|
v
Current Process
|
| migrate
v
Another Process
Why?
One reason is session stability or aligning the session with a desired privilege context.
But process migration can fail, and the Blue room explicitly warns that it may require multiple attempts. (TryHackMe)
🛠️ Hands-On / Commands — Task 3
Tools Used
Metasploit sessions
Meterpreter
Process enumeration
Privilege verification
Process migration
Windows shell
Useful commands:
sessions -l
getuid
sysinfo
ps
migrate <PID>
To temporarily enter a Windows shell:
shell
Then:
whoami
I have intentionally excluded the exact shell-upgrade module path, required session value, and process ID used in the room.
Task 4 — Cracking
After obtaining sufficient privileges, the room introduces:
Password Hashes
Operating systems should not normally store user passwords as readable plaintext.
Instead, password-derived values are stored using cryptographic mechanisms.
Conceptually:
Password
↓
Hashing
↓
Stored Hash
An attacker who obtains password hashes may attempt offline password cracking.
The Blue room demonstrates this by having learners dump Windows credential hashes from an elevated Meterpreter session and then research how to crack the non-default user's password. (TryHackMe)
Hash Dumping
Within a sufficiently privileged Meterpreter session, the room introduces:
hashdump
The resulting entries conceptually contain information such as:
Username
RID
LM-related field
NTLM hash
I am not publishing the actual username or hash from the lab.
Hashing Is Not Encryption
This distinction matters.
Encryption:
Plaintext
↓
Encryption + Key
↓
Ciphertext
↓
Decryption + Key
↓
Plaintext
Hashing:
Password
↓
Hash Function
↓
Hash
There is no ordinary:
Decrypt hash
operation.
Password cracking instead tests candidate passwords:
Candidate Password
↓
Hash it
↓
Compare
↓
Match?
Dictionary Attack
A dictionary attack uses a list of possible passwords.
Conceptually:
password1
football
welcome
example123
...
Each candidate is hashed and compared against the target hash.
Wordlist
↓
Candidate
↓
Hash
↓
Compare with captured hash
↓
Match → password identified
This also demonstrates why weak and common passwords are dangerous.
John the Ripper
A general learning syntax is:
john --format=<HASH_FORMAT> --wordlist=<WORDLIST> hashes.txt
Then:
john --show hashes.txt
can display successfully recovered results.
Hashcat
Hashcat follows a similar concept.
Generic syntax:
hashcat -m <MODE> hashes.txt <WORDLIST>
The correct hash mode depends on the hash format.
Cybersecurity Lesson
Strong password security depends on more than users choosing slightly complicated passwords.
Modern systems should also consider:
Strong password hashing
Unique salts
Appropriate work factors
MFA
Password policies
Detection of credential attacks
🛠️ Hands-On / Commands — Task 4
Tools Used
Meterpreter
hashdump
John the Ripper
Hashcat
Password wordlists
Generic workflow:
Privileged session
↓
Dump hash
↓
Identify hash type
↓
Save hash to file
↓
Choose cracking tool
↓
Select wordlist
↓
Attempt offline crack
No lab username, hash, or recovered password is included.
Task 5 — Find Flags!
The final task moves into:
Post-Exploitation Enumeration
After gaining access to a machine, exploitation itself is not necessarily the end goal.
A penetration tester may now investigate:
System configuration
User directories
Sensitive files
Credentials
Application data
Administrative resources
The Blue room places three educational flags in Windows locations chosen to reinforce knowledge of important parts of the filesystem. (TryHackMe)
Windows Filesystem Enumeration
A normal Windows shell can be used to explore the filesystem.
Useful commands include:
cd
dir
To check the current identity:
whoami
To view system information:
systeminfo
Meterpreter File Navigation
Meterpreter provides similar commands:
pwd
ls
cd <DIRECTORY>
cat <FILE>
This made it easier to connect what I had learned in the Windows Fundamentals rooms with actual post-exploitation enumeration.
Search Rather Than Guess
A good post-exploitation habit is:
Understand the hint
↓
Think about Windows structure
↓
Navigate logically
↓
Search when necessary
instead of randomly opening every folder.
Some useful questions are:
Where does Windows keep system-level data?
Where is credential-related information stored?
Where do administrator profiles live?
Which directories would contain interesting user documents?
I am intentionally leaving the actual flag paths and values for learners to discover themselves.
🛠️ Hands-On / Commands — Task 5
Tools Used
Meterpreter
Windows filesystem
Command Prompt
Directory enumeration
File searching
Useful generic commands:
cd \
dir
dir /a
Meterpreter:
pwd
ls
cd <DIRECTORY>
The practical workflow was:
Read hint
↓
Identify likely Windows area
↓
Navigate
↓
Inspect directory
↓
Locate interesting file
↓
Understand why that location matters
No flag paths or flag contents are included.
Full Attack Chain
This room gave me my first clear view of an end-to-end Windows exploitation workflow:
TARGET WINDOWS HOST
|
v
RECONNAISSANCE
|
Nmap
|
v
Identify Open Services
|
v
Research Known Vulnerability
|
v
METASPLOIT
|
v
Initial Foothold
|
v
Background Session
|
v
Upgrade to Meterpreter
|
v
Verify Privilege Level
|
v
Enumerate Processes
|
v
Process Migration
|
v
Credential Dumping
|
v
Offline Cracking
|
v
Post-Exploitation Search
Tools Used
| Tool / Command | Purpose |
|---|---|
| Nmap | Port and service enumeration |
-sC |
Run default Nmap scripts |
-sV |
Service/version detection |
| Metasploit | Exploitation framework |
search |
Find Metasploit modules |
use |
Select a module |
show options |
Inspect module parameters |
set |
Configure options |
sessions |
Manage active sessions |
| Meterpreter | Post-exploitation session |
getuid |
Check current Meterpreter identity |
sysinfo |
Inspect target information |
ps |
List processes |
migrate |
Move Meterpreter into another process |
shell |
Open native Windows shell |
whoami |
Display current Windows identity |
hashdump |
Dump Windows password hashes when privileges permit |
| John the Ripper | Offline password cracking |
| Hashcat | Offline hash cracking |
dir / ls |
Filesystem enumeration |
Key Lessons Learned
1. Recon Comes Before Exploitation
A better workflow is:
Scan
↓
Understand service
↓
Research
↓
Validate
↓
Exploit
not:
Random exploit
↓
Hope
2. Open Ports Reveal Attack Surface
Every exposed service gives me something to investigate:
Port
↓
Service
↓
Version
↓
Configuration
↓
Possible vulnerability
3. Exploit and Payload Are Different
This became much clearer during Metasploit.
Exploit
=
How we gain execution
Payload
=
What executes afterwards
Understanding the difference makes Metasploit much easier to use.
4. Getting a Shell Is Only the Beginning
Initial access may provide only limited functionality.
The next questions are:
Who am I?
What privileges do I have?
What processes are running?
Can I improve the session?
What information is accessible?
5. Meterpreter Is a Post-Exploitation Environment
Meterpreter provides much more functionality than a basic command shell.
I practiced:
Session management
System enumeration
Process listing
Process migration
Credential collection
Filesystem navigation
6. Password Hashes Can Still Be Valuable to Attackers
Even when passwords are not stored as plaintext, weak passwords can sometimes be recovered through offline guessing.
That reinforces why:
Strong unique passwords
+
Modern password storage
+
MFA
matter.
7. Enumeration Continues After Exploitation
Reconnaissance is not only something done before exploitation.
After gaining access, we perform local enumeration:
Users
Files
Processes
Credentials
Configuration
System locations
That determines what can be done next.
Defensive Perspective
The Blue room is an exploitation lab, but it also teaches important lessons for defenders.
The attack chain begins with an exposed, vulnerable service.
A defensive strategy therefore includes:
Patch vulnerable operating systems
↓
Disable unnecessary legacy protocols
↓
Restrict exposed network services
↓
Segment networks
↓
Monitor suspicious SMB activity
↓
Use endpoint protection
↓
Use strong passwords
↓
Monitor credential dumping
The vulnerability family demonstrated by Blue became particularly well known because similar weaknesses were later abused at large scale, including during the WannaCry outbreak. TryHackMe's Metasploit material uses the same EternalBlue family to explain how an SMB vulnerability can lead to remote code execution on vulnerable Windows systems. (TryHackMe)
My Final Mental Model
WINDOWS EXPLOITATION
|
v
NMAP
|
v
OPEN SERVICES
|
v
VULNERABILITY RESEARCH
|
v
METASPLOIT
|
v
SHELL
|
v
METERPRETER
|
┌──────────┼──────────┐
| | |
SYSTEM PROCESSES FILES
| | |
Privilege Migration Search
| | |
└──────────┼──────────┘
|
v
CREDENTIALS
|
v
PASSWORD HASHES
|
v
CRACKING
|
v
POST-EXPLOITATION
Ethical Learning Note
Everything described here was practiced only inside the authorized TryHackMe lab environment.
This article includes:
✅ Recon methodology
✅ Generic Nmap commands
✅ Metasploit concepts
✅ Session-management workflow
✅ Meterpreter concepts
✅ Generic password-cracking syntax
✅ Post-exploitation methodology
✅ Defensive lessons
while intentionally excluding:
❌ TryHackMe flags
❌ Exact task-answer vulnerability ID
❌ Exact exploit module answer
❌ Lab target IP
❌ Lab process ID
❌ Password hash
❌ Cracked password
❌ Flag locations
❌ Direct room-question answers
The goal is to document how I approached the machine and what I learned, while leaving the actual TryHackMe challenges for other learners to solve.
Resources
🌐 TryHackMe Room: Blue
👨💻 TryHackMe Profile: sunnysharma11200
💻 GitHub Repository: tryhackme-writeups
✍️ Hashnode Blog: cybersecurity-learning.hashnode.dev
Connect with Me
TryHackMe: sunnysharma11200
GitHub: SunnySharma04
Hashnode: cybersecurity-learning
LinkedIn: Sunny Sharma
Happy Learning! 🚀
