Advent of Cyber 2025 – Day 1 Walkthrough

Welcome to Advent of Cyber 2025 – Day 1!
Today we investigate a major incident in Wareville: McSkidy has been kidnapped, the town is collapsing, and our only lead is a compromised Linux server — tbfc-web01.
In this walkthrough, we explore the room step-by-step and uncover how the attackers infiltrated the system and replaced Christmas with EASTMAS.

What you’ll learn today:
– Navigating the Linux command-line interface (CLI)
– Listing files, reading hidden files, and moving through directories
– Using commands like grep, find, and cat for investigation
– Checking logs for failed login attempts
– Analyzing a suspicious shell script
– Switching users and viewing bash history to uncover attacker footprints

Story Context:
McSkidy left hidden clues in her files, warning us about King Malhare and HopSec Island. By following her guide, we dig through logs, hidden directories, and suspicious scripts to reveal how the attackers replaced the wishlist system with EASTMAS propaganda.

TryHackMe Room:
Advent of Cyber 2025 – Day 1
https://tryhackme.com/adventofcyber25

If you’re doing Advent of Cyber this year, let me know your progress in the comments!

Subscribe for all daily Advent of Cyber walkthroughs.

#adventofcyber #adventofcyber2025 #tryhackme #tryhackmechallenge #cybersecurity #infosec #ethicalhacking #ctf #hackthebox #learncybersecurity #linux #commandline #linuxbasics #grep