Skip to main content

THM | Windows Privilege Escalation

· 13 min read

Red Teaming | Windows Privilege Escalation | Description:​

Notes taken while exploring the Windows Privilege Escalation room on the Red Teaming Path. The primary goal is to master the fundamentals of Windows privilege‑escalation techniques.

THM | Enumeration

· 12 min read

Red Teaming | Enumeration | Summary:​

This room is designed to introduce learners to post-exploitation enumeration techniques within unknown corporate environments.

It covers both Linux and Windows systems, detailing various methods for gathering system information, identifying users, understanding networking configurations, and listing running services.

The room also explores DNS, SMB, and SNMP protocols, along with additional tools like Sysinternals Suite, Process Hacker, and GhostPack Seatbelt, specifically for Windows enumeration.

THM | The Lay of the Land

· 20 min read

Red Teaming | The Lay of the Land | Summary:​

This room offers hands-on learning about corporate security technologies. It covers Active Directory (AD) management, host solutions like antivirus, firewalls, Sysmon, HIDS/HIPS, EDR, network security with firewalls, SIEM, and IDS/IPS, plus applications and services including installed programs, processes, file sharing, DNS, local apps.

More importantly, it equips learners with practical knowledge of corporate security infrastructures.

THM | Phishing

· 11 min read

Red Teaming | Phishing | Summary:​

This room focuses on teaching the basics of phishing attacks and their importance in red team engagements.

The room takes you through various aspects of phishing, including setting up infrastructure, writing convincing emails, and using different tools like GoPhish and techniques like Typosquatting to trick targets into opening malicious links or attachments.

THM | Password Attacks

· 29 min read

Red Teaming | Password Attacks | Summary:​

This room is designed to teach about various strategies and techniques used in cracking or guessing passwords. It covers both offline and online methods, including dictionary and brute-force attacks, rule-based attacks, and custom rules.

The room emphasizes password profiling, teaching users how to create effective wordlists using default, weak, leaked, combined, and username sources.

Other topics include keyspace techniques, CUPP (Custom Password Profile), and online attacks targeting FTP, SMTP, SSH, and HTTP login pages. Additionally, it introduces the concept of password spraying attacks.

THM | Weaponization

· 18 min read

Red Teaming | Weaponization | Summary:​

The room focuses on alternative scripting techniques used by red teamers to execute payloads in a Windows environment.

Since many organizations restrict or monitor the execution of .exe files, this room explores other methods, including Windows Script Host, HTML Applications, Visual Basic Applications, and PowerShell.

The goal is to learn and practice these techniques, which are commonly used by attackers to bypass security controls and execute malicious code.

THM | Red Team Recon

· 14 min read

Red Teaming | Red Team Recon | Summary:​

The room provides training on different types of reconnaissance, including WHOIS and DNS-based reconnaissance, advanced searching techniques, and specialized search engines.

Additionally, it delves into specific tools and techniques such as Google Hacking, Recon-ng, and Maltego, offering a comprehensive understanding of the reconnaissance process in a cyber attack or penetration test scenario.

Overall, it aims to equip users with the skills and knowledge necessary to gather valuable information about a target using various reconnaissance methods and tools.

THM | Red Team OPSEC

· 10 min read

Red Teaming | Red Team OPSEC | Summary:​

This room is focused on applying the OPSEC process in the context of Red Team operations. The content likely covers strategies and techniques for protecting sensitive information from adversaries, including identifying threats, vulnerabilities, and risks, and implementing countermeasures to stay one step ahead.

THM | Red Team Threat Intel

· 9 min read

Red Teaming | Red Team Threat Intel | Summary:​

In this room, you'll learn how to harness the power of threat intelligence in red team engagements. You'll discover how to apply threat intel concepts to drive your campaigns, understand key frameworks like TIBER-EU, and practice using threat intelligence to inform your tactics, techniques, and procedures (TTPs).

Through interactive challenges and real-world examples, you'll gain a deeper understanding of how to create a threat-intel-driven campaign that sets you apart as a red team operator.

THM | Red Team Engagements

· 12 min read

Red Teaming | Red Team Engagements | Summary:​

This room serves as a guide for Red Team engagements, covering essential steps such as defining scope and objectives, establishing rules of engagement, and planning campaigns, to ensure successful execution and effective documentation of the exercise.

It provides a structured approach to setting up and conducting a Red Team engagement, from conceptualizing the project to executing it, including key operational plans and mission-specific details.

THM | Windows Internals

· 14 min read

Malware Analysis | Windows Internals | Summary:​

This room aims to provide an in-depth exploration of Windows operating system internals and common components. Important concepts like Processes, Threads, Virtual Memory, DLLs, PE and the Window API are introduced.

THM | x86 Assembly Crash Course

· 13 min read

Malware Analysis | x86 Assembly Crash Course | Summary:​

The room discusses various aspects of x86 assembly language programming, covering essential concepts such as opcodes and operands, general assembly instructions, arithmetic and logical instructions, conditionals, and branching instructions.

It also includes some warnings about the use of these instructions in real-world scenarios, particularly related to shellcode injection.

THM | x86 Architecture Overview

· 8 min read

Malware Analysis | x86 Architecture Overview | Summary:​

The room provides an overview of CPU architecture, explaining how it executes instructions and interacts with external components. It details the basic components of a CPU (Control Unit, Arithmetic Logic Unit, Registers) and how they interact with memory and I/O devices.

It then delves deeper into registers, explaining their types (Instruction Pointer, General-Purpose Registers, Status Flag Registers), and how they are used to store data temporarily while it is being processed by the CPU. Additionally, the room covers program memory layout, highlighting the importance of the stack in malware analysis, and explains common malware techniques such as stack buffer overflow attacks.

THM | Intro to Malware Analysis

· 7 min read

Malware Analysis | Intro to Malware Analysis | Summary:​

The aim of this room is to provide SOC analysts with steps to determine whether suspicious content (files or traffic) is malicious or not. It will cover the basics of malware, how to start analyzing it, and different analysis methods, as well as resources for further assistance.

HTB | Under Construction

· 16 min read

HTB | Under Construction | Summary:​

We prepare for a challenge by preparing challenge files, then proceed to perform source code analysis using VSCodium. As we delve into the code, we identify vulnerabilities in the "requirements" section (CVE-2023-2142, CWE-1321), as well as a SQL Injection vulnerability within the "getUser()" function located in the "helpers/DBHelper.js" file. Furthermore, we discover additional vulnerabilities in the "helper/JWT.js" file, specifically CVE-2022-23539, CVE-2022-23540, and CVE-2022-23541. We then exploit CVE-2022-23541 to gain access, followed by exploiting the SQL Injection vulnerability within the "getUser()" function.

As we navigate through the application, we determine the selected row and column number of interest. Next, we identify a table called "flag_storage" containing sensitive information, along with a specific column labeled as "top_secret_flag". With this knowledge in hand, we proceed to grab the flag from its designated location. We then submit our findings, encapsulating the flag within an HTB{...} notation, and declare Challenge Completed once this task is accomplished.

Challenge Name: Under Construction | Difficulty: Medium | Category: Web

HTB | Blue

· 15 min read

HTB | Blue | Summary:​

We spawn a target machine, then perform reconnaissance to gather initial information about its services and vulnerabilities. We identify an SMB vulnerability, which we investigate further by searching for applicable exploits (specifically CVE-2017-0144).

Using this knowledge, we configure an exploit with Metasploit to take advantage of the discovered vulnerability. Next, we verify the vulnerability's presence using Metasploit's capabilities. With the exploit confirmed, we run it against the target machine, leveraging its SMB vulnerability to gain access. We then proceed to grab both the user flag and root flag, ultimately achieving System Own status once these tasks are accomplished.

Machine Name: Blue | Difficulty: Easy | OS: Windows

HTB | Netmon

· 19 min read

HTB | Netmon | Summary:​

We navigate the Hack The Box website starting by spawning a target machine. Next, we perform reconnaissance on the target to gather initial information and identify an FTP server running on it. We use anonymous authentication to access the FTP share, then enumerate the files available on this share.

Continuing our investigation, we access the NETMON configuration files and extract user credentials from them. Modifying these credentials to suit our needs, we proceed to access the PRTG Network Monitor web interface. Utilizing Metasploit's capabilities, we exploit CVE-2018-9276 to gain shell access with the "LocalSystem" account, thereby achieving system level access. With this access in hand, we grab both the user flag and root flag, ultimately declaring System Own status once these tasks are accomplished.

Machine Name: Netmon | Difficulty: Easy | OS: Windows

HTB | You know 0xDiablos

· 25 min read

HTB | You know 0xDiablos | Summary:​

We prepare for a challenge by preparing challenge files and testing the executable. Next, we perform static analysis using Ghidra to identify potential vulnerabilities. Upon discovering a buffer overflow vulnerability, we verify its existence and proceed to analyze the target architecture and endianness using pwntools' checksec feature.

With this information in hand, we use GDB and PEDA to identify the offset and address of the flag() function. We then craft a malicious payload using pwntools to smash the stack and exploit the vulnerability. Before submitting the exploit to the target machine, we verify its effectiveness against a local copy of the executable. After successfully exploiting the target, we submit our exploit and grab the recovered flag, declaring Challenge Completed once the task is accomplished.

Challenge Name: You know 0xDiablos | Difficulty: Easy | Category: Pwn

HTB | Jerry

· 15 min read

HTB | Jerry | Summary:​

We navigate the Hack The Box website, starting by spawning a target machine. Next, we perform reconnaissance on the target to gather initial information. We identify a running webserver and proceed with directory enumeration using gobuster to uncover hidden directories. After discovering a server status login page with default credentials, we log in to gain access to the Manager App website.

Analyzing this app further, we collect the necessary credentials to log in and then identify a file upload vulnerability on the website. We create a malicious payload using msfvenom, which we use to upload and execute a reverse shell on the target machine. With a stable shell established at system level access, we proceed to grab both the user flag and root flag, ultimately achieving System Own status.

Machine Name: Jerry | Difficulty: Easy | OS: Windows

HTB | Weak RSA

· 14 min read

HTB | Weak RSA | Summary:​

We navigate the Hack The Box website, preparing for a challenge by preparing challenge files and setting up the RsaCtfTool. We use this tool to crack a weak public key, and then generate a private key. Next, we utilize RsaCtfTool to decrypt an encrypted flag, which ultimately leads us to submit the recovered flag as our solution.

Challenge Name: Weak RSA | Difficulty: Easy | Category: Crypto

HTB | Find The Easy Pass

· 14 min read

HTB | Find The Easy Pass | Summary:​

We navigate the Hack The Box CTF platform, preparing for a challenge by preparing challenge files and testing the executable. We then perform static analysis using Ghidra and dynamic analysis with OllyDbg to gain insight into its behavior.

Next, we run the executable with test data and track where it stores this data in memory, checking the surrounding environment to better understand the context. With this knowledge, we extract the password and verify it by running the executable again with the password as input. Finally, we submit the flag as HTB{<password>} and declare Challenge Completed.

Challenge Name: Find The Easy Pass | Difficulty: Easy | Category: Reversing

HTB | Lame

· 15 min read

HTB | Lame | Summary:​

We start by identifying vulnerabilities through reconnaissance and exploiting a Samba vulnerability (CVE-2007-2447) using Metasploit. We then escalate privileges to achieve root access, retrieving both user and root flags in the process, demonstrating complete control over the system.

Machine Name: Lame | Difficulty: Easy | OS: Linux

HTB | Base

· 19 min read

HTB | Base | Summary:​

We test connectivity, scan, and enumerate the target website. We discover a PHP type juggling vulnerability and exploit it to gain access to the admin file uploads directory. Using this access, we upload a web shell via the upload functionality. Enumerating the system with our new tool, we find clear text credentials that grant us user-level SSH access. We then escalate to root by exploiting sudo using find. Finally, we grab the root flag.

Machine Name: Base | Difficulty: Easy | OS: Linux

HTB | Markup

· 18 min read

HTB | Markup | Summary:​

We test connectivity to the target and scan it, then enumerate its website and login with some default credentials. Once we have user access, we continue enumerating the site. Analyzing the page source code reveals the used XML version and a potential username.

We exploit the found XXE vulnerability to leak the user's private SSH key, allowing us to access the target machine via SSH and gain user-level access. Next, we grab the user flag. With our foothold established, we enumerate the machine with user-level access until we find a job.bat file that runs with administrator privileges. We exploit this by modifying the scheduled job to run our reverse shell, wait for it to execute, and catch the connection to gain administrative access to the target machine. Finally, we grab the root flag.

Machine Name: Markup | Difficulty: Easy | OS: Windows

HTB | Included

· 31 min read

HTB | Included | Summary:​

We test connectivity and scan the target, then enumerate its TFTP service and web page. We find an unauthenticated upload function on TFTP and a Local File Inclusion (LFI) vulnerability on the web page. We use these to upload a PHP reverse shell and gain low-level access via LFI.

With this foothold, we upgrade our access to user level using the acquired clear-text credentials. We then grab the user flag, enumerate further, and exploit privilege escalation opportunities to reach root level access with the help of the lxdprivesc script. Finally, we obtain the root flag.

Machine Name: Included | Difficulty: Easy | OS: Linux

HTB | Unified

· 25 min read

HTB | Unified | Summary:​

We test connectivity and scan the target, then enumerate its web app and identify vulnerabilities. We find a Log4Shell vulnerability and exploit it using Metasploit to get a reverse shell connection with low-level access. From there, we grab the user flag and use our access to modify the admin credentials in the MongoDB database. We then log in as admin and change the recorded SSH credentials to ones under our control, granting us root privileges. Finally, we obtain the root flag.

Machine Name: Unified | Difficulty: Easy | OS: Linux

HTB | Vaccine

· 28 min read

HTB | Vaccine | Summary:​

We test connectivity and scan the target, then use anonymous FTP access to download and crack a zip archive using John the Ripper. Analyzing the source code and exploiting a hardcoded hash gives us web app access via compromised credentials.

We identify an SQL injection vulnerability, gain control, and upgrade to a reverse shell with low-privileged access. As we enumerate the machine, we find privilege escalation opportunities and exploit SUDO vulnerabilities to gain root access, ultimately obtaining both user and root flags.

Machine Name: Vaccine | Difficulty: Easy | OS: Linux

HTB | Oopsie

· 19 min read

HTB | Oopsie | Summary:​

This article guides users through completing the Oopsie machine challenge on Hack The Box. The steps outline a hacking scenario, from initial connection testing and scanning to exploiting vulnerabilities in a web application, including IDOR, cookie manipulation, and SUID exploitation, ultimately leading to gaining admin access and finally grabbing the root flag.

Machine Name: Oopsie | Difficulty: Easy | OS: Linux

HTB | Archetype

· 22 min read

HTB | Archetype | Summary:​

This article guides users through completing the Archetype machine challenge on Hack The Box. We exploit vulnerabilities on a Microsoft SQL Server by enumerating SMB shares, finding clear text credentials, and using Impacket to authenticate and gain an authorized connection. We then escalate privileges and download Netcat to establish a reverse shell, grab the user flag, and eventually use Impacket's psexec tool to gain admin access and retrieve the root flag before terminating the connection.

Machine Name: Archetype | Difficulty: Easy | OS: Windows

HTB | Tactics

· 16 min read

HTB | Tactics | Summary:​

This walkthrough provides step-by-step guidance on how to solve the Tactics machine challenge on Hack The Box, focusing on completing Tier 1 Starting Point challenges. The guide covers various tasks and techniques using Nmap, SMB protocols, and Impacket tools to ultimately obtain the root flag and "pwn" the target machine.

Machine Name: Tactics | Difficulty: Easy | OS: Windows

HTB | Pennyworth

· 12 min read

HTB | Pennyworth | Summary:​

This article guides users through completing the Pennyworth machine challenge on Hack The Box. Here we conduct reconnaissance on a Jenkins server, discovering a login page and default credentials, as well as a vulnerable Script Console that can execute Groovy scripts. We exploit this vulnerability to gain access to the system and retrieve a flag located at "/root/flag.txt".

Machine Name: Pennyworth | Difficulty: Easy | OS: Linux

HTB | Funnel

· 10 min read

HTB | Funnel | Summary:​

This walkthrough guides users through solving the Funnel machine challenges on Hack The Box, covering tasks such as network scanning, file analysis, and database interactions to ultimately acquire flags.

Machine Name: Funnel | Difficulty: Easy | OS: Linux

HTB | Ignition

· 10 min read

HTB | Ignition | Summary:​

This article guides users through completing the Ignition machine challenge on Hack The Box. It covers tasks such as service version identification, HTTP status code retrieval, web fingerprinting, and brute force directory discovery, ultimately leading to gaining access to the Magento admin page and submitting the root flag.

Machine Name: Ignition | Difficulty: Easy | OS: Linux

HTB | Three

· 16 min read

HTB | Three | Summary:​

This article guides users through completing the Three machine challenge on Hack The Box. This is a web hacking challenge that involves exploiting vulnerabilities in an S3 bucket and executing a reverse shell on the target machine. The goal is to retrieve the "flag" file from the target machine.

Machine Name: Three | Difficulty: Easy | OS: Linux

HTB | Responder

· 15 min read

HTB | Responder | Summary:​

This walkthrough outlines the attack vector used to system access on the Responder machine on Hack The Box, where an attacker would exploit the NetBIOS vulnerability to capture NTLMv2 hashes, which are then cracked using John the Ripper to obtain valid credentials. These credentials can be leveraged to ultimately gain access to root flag on the target machine.

Machine Name: Responder | Difficulty: Easy | OS: Windows

HTB | Crocodile

· 8 min read

HTB | Crocodile | Summary:​

This walkthrough provides help solving the Crocodile machine on Hack The Box. The guide covers various topics, including Nmap scanning, service version identification, FTP login procedures, and directory brute force using Gobuster.

Machine Name: Crocodile | Difficulty: Easy | OS: Linux

HTB | Sequel

· 7 min read

HTB | Sequel | Summary:​

This walkthrough assists with solving the Sequel machine challenge on Hack The Box, focusing on tasks related to MySQL. Key takeaways include understanding various SQL concepts, utilizing tools like Nmap, and exploiting vulnerabilities to gain access to sensitive information, including a "root flag" in the "htb" database.

Machine Name: Sequel | Difficulty: Easy | OS: Linux

HTB | Appointment

· 7 min read

HTB | Appointment | Summary:​

This walkthrough provides assistance with solving the Appointment machine challenge on Hack The Box, focusing on tasks related to SQL, MySQL, and MariaDB, while highlighting potential security vulnerabilities such as SQL injection. Key takeaways include understanding various SQL concepts, utilizing tools like Nmap and Gobuster, and exploiting vulnerabilities to gain access to sensitive information.

Machine Name: Appointment | Difficulty: Easy | OS: Linux

HTB | Synced

· 5 min read

HTB | Synced | Summary:​

This walkthrough provides help with solving the Synced machine challenge on Hack The Box, focusing on tasks related to rsync and its usage on the target machine. Key takeaways include understanding the default port for rsync (873), using anonymous authentication, and listing shares and files with the correct options.

Machine Name: Synced | Difficulty: Easy | OS: Linux

HTB | Mongod

· 7 min read

HTB | Mongod | Summary:​

This walkthrough guides beginners through completing the Mongod machine challenge on Hack The Box, covering essential steps and commands to solve Tier 0 challenges, including interacting with MongoDB and managing databases. It provides step-by-step instructions on how to connect to the target machine, use nmap and other tools, and submit the root flag.

Machine Name: Mongod | Difficulty: Easy | OS: Linux

HTB | Preignition

· 7 min read

HTB | Preignition | Summary:​

This walkthrough provides step-by-step guidance on completing the Preignition machine challenge on Hack The Box, a series of tutorials designed to help beginners complete Tier 0 challenges. The guide covers directory brute-forcing techniques, using nmap and gobuster tools, and submitting the root flag.

Machine Name: Preignition | Difficulty: Easy | OS: Linux

HTB | Explosion

· 4 min read

HTB | Explosion | Summary:​

This article guides users through completing the Explosion machine challenge on Hack The Box. The guide covers tasks such as connecting to the target machine via pwnbox, identifying open TCP ports, understanding remote access protocols and tools, and obtaining flags through a series of questions and exercises.

Machine Name: Explosion | Difficulty: Easy | OS: Windows

HTB | Redeemer

· 13 min read

HTB | Redeemer | Summary:​

This article guides users through completing the Redeemer machine challenge on Hack The Box. Through a series of tasks, users are guided in connecting to the target machine via pwnbox, identifying open TCP ports, determining service versions, understanding Redis database types, using command-line utilities for interaction, and obtaining flags.

Machine Name: Redeemer | Difficulty: Easy | OS: Linux

HTB | Dancing

· 10 min read

HTB | Dancing | Summary:​

This article guides users through completing the Dancing machine challenge on Hack The Box. It covers tasks related to SMB, such as listing shares, accessing shares with a blank password, and downloading files using the SMB shell. The final step is to find and submit the root flag.

Machine Name: Dancing | Difficulty: Easy | OS: Windows

OverTheWire | Bandit | Levels 30-34

· 7 min read

OverTheWire | Bandit | Levels 30-34 | Summary:​

A write-up providing help with the Bandit wargame on the OverTheWire website, consisting of a series of 32 levels, followed by an additional challenge using an 'uppercase shell' trick at Level 33, that covers various Linux and shell scripting topics. The challenges range from basic navigation to more advanced topics like SSH authentication, file permissions, and Git usage.

Wargame Name: Bandit | Difficulty: Easy | OS: Linux

OverTheWire | Bandit | Levels 20-29

· 13 min read

OverTheWire | Bandit | Levels 20-29 | Summary:​

A write-up providing help with the Bandit wargame on the OverTheWire website, consisting of a series of 32 levels, followed by an additional challenge using an 'uppercase shell' trick at Level 33, that covers various Linux and shell scripting topics. The challenges range from basic navigation to more advanced topics like SSH authentication, file permissions, and Git usage.

Wargame Name: Bandit | Difficulty: Easy | OS: Linux

OverTheWire | Bandit | Levels 10-19

· 7 min read

OverTheWire | Bandit | Levels 10-19 | Summary:​

A write-up providing help with the Bandit wargame on the OverTheWire website, consisting of a series of 32 levels, followed by an additional challenge using an 'uppercase shell' trick at Level 33, that covers various Linux and shell scripting topics. The challenges range from basic navigation to more advanced topics like SSH authentication, file permissions, and Git usage.

Wargame Name: Bandit | Difficulty: Easy | OS: Linux

OverTheWire | Bandit | Levels 01-09

· 6 min read

OverTheWire | Bandit | Levels 01-09 | Summary:​

A write-up providing help with the Bandit wargame on the OverTheWire website, consisting of a series of 32 levels, followed by an additional challenge using an 'uppercase shell' trick at Level 33, that covers various Linux and shell scripting topics. The challenges range from basic navigation to more advanced topics like SSH authentication, file permissions, and Git usage.

Wargame Name: Bandit | Difficulty: Easy | OS: Linux

OverTheWire | Bandit | Level 00

· 4 min read

OverTheWire | Bandit | Level 00 | Summary:​

A write-up providing help with the Bandit wargame on the OverTheWire website, consisting of a series of 32 levels, followed by an additional challenge using an 'uppercase shell' trick at Level 33, that covers various Linux and shell scripting topics. The challenges range from basic navigation to more advanced topics like SSH authentication, file permissions, and Git usage.

Wargame Name: Bandit | Difficulty: Easy | OS: Linux

THM | Kenobi

· 3 min read

Basic Computer Exploitation | Kenobi | Summary:​

This series of walkthroughs aims to help out complete beginners with finishing the Complete Beginner path on the TryHackMe website. It is based on the learning content provided in the Kenobi room.

THM | Vulnversity

· 2 min read

Basic Computer Exploitation | Vulnversity | Summary:​

This series of walkthroughs aims to help out complete beginners with finishing the Complete Beginner path on the TryHackMe website. It is based on the learning content provided in the Vulnversity room.

THM | Blue

· 4 min read

Windows Exploitation Basics | Blue | Summary:​

This series of walkthroughs aims to help out complete beginners with finishing the Complete Beginner path on the TryHackMe website. It is based on the learning content provided in the Blue room.

THM | Pickle Rick

· One min read

Web Hacking Fundamentals | Pickle Rick | Summary:​

This series of walkthroughs aims to help out complete beginners with finishing the Complete Beginner path on the TryHackMe website. It is based on the learning content provided in the Pickle Rick room.

THM | Nmap

· 6 min read

Network Exploitation Basics | Nmap | Summary:​

This series of walkthroughs aims to help out complete beginners with finishing the Complete Beginner path on the TryHackMe website. It is based on the learning content provided in the Nmap room.

THM | Tutorial

· One min read

Complete Beginner Introduction | Tutorial | Summary:​

This series of walkthroughs aims to help out complete beginners with finishing the Complete Beginner path on the TryHackMe website. It is based on the learning content provided in the Tutorial room.