Lab Overview

Room Objective

Learn how attackers exploit vulnerable and misconfigured systems, and how you can protect them. The room covers system-based attack vectors that bypass the human layer entirely, including software vulnerabilities (CVEs), misconfigurations, and supply chain attacks, and how SOC analysts and IT teams respond to each.

Methodology / Approach

Worked through each task sequentially, distinguishing between the three primary system attack routes. Applied the key distinction between vulnerabilities and misconfigurations, then engaged with the interactive security dashboard to make live analyst decisions on systems at risk and build a remediation plan.

Walkthrough

Key Concepts Covered

• System definition: A system is any physical server, virtual machine, or cloud platform where data or services live. Breaching a single system (e.g. a mail server) can compromise thousands of users at once.
• Can attacks happen without victim intervention? Yes, attackers can exploit unpatched vulnerabilities or misconfigurations directly, with no human interaction required.

Three system attack routes:

Vulnerability vs Misconfiguration — critical distinction:

• CVE lifecycle: Once a vulnerability goes public and gets a CVE number, it's a race, attackers build exploits while defenders patch. Zero-days are the worst case: no patch exists yet, so defenders must restrict access, apply vendor workarounds, and monitor obsessively.
• ToolShell CVE: CVE-2025-53770 — critical SharePoint vulnerability dubbed "ToolShell", identified during room research task.
• Supply chain risk: Even TryHackMe was affected by a supply chain attack via Lottie Player, a library used for room animations.