--- title: "TryHackMe — Guided Pentest: Infrastructure | Full Walkthrough" url: https://daily.dev/posts/tryhackme-guided-pentest-infrastructure-full-walkthrough-d3y3lmysw source_url: https://infosecwriteups.com/tryhackme-guided-pentest-infrastructure-full-walkthrough-8984cd1806f4 type: article source: "InfoSec Write-ups" published: 2026-08-17T21:35:19.269Z updated: 2026-08-17T21:35:43.922Z tags: ["security", "linux"] reading_time: 7 upvotes: 4 comments: 0 language: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # TryHackMe — Guided Pentest: Infrastructure | Full Walkthrough **[InfoSec Write-ups](https://daily.dev/sources/infosecwriteups)** · 7 min read · 4 upvotes · 0 comments ## Summary A step-by-step walkthrough of TryHackMe's 'Guided Pentest: Infrastructure' room, covering the full penetration testing workflow: Nmap enumeration, identifying UnrealIRCd 3.2.8.1 as vulnerable, exploiting its known backdoor via Metasploit to gain a shell as 'webmaster', discovering a plaintext root password in /etc/password.txt, escalating to root over SSH, and drafting a sample vulnerability report with remediation advice. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Questions this post answers ### How do I exploit the UnrealIRCd 3.2.8.1 backdoor with Metasploit? Use the exploit/unix/irc/unreal_ircd_3281_backdoor Metasploit module, which targets a backdoor secretly inserted into UnrealIRCd 3.2.8.1's source code at the time it was distributed. Set RHOSTS to the target IP, LHOST to your attacker IP, RPORT to 6667 (IRC), choose a reverse shell payload like cmd/unix/reverse, then run exploit to get a command shell, typically as a low-privileged user such as webmaster. _daily.dev surfaces writeups like this for anyone practicing real exploit chains against known CVEs._ ### What tool finds known exploits for a specific software version like UnrealIRCd 3.2.8.1? Searchsploit is a command-line tool that queries an offline copy of the Exploit-DB database for known vulnerabilities matching a given service and version. Running searchsploit UnrealIRCd returns multiple entries, including a Backdoor Command Execution exploit with a ready Metasploit module and a Remote Downloader/Execute script at linux/remote/13853.pl. _Security researchers track exploit tooling and vulnerability research workflows on daily.dev._ --- Tags: [#security](https://daily.dev/tags/security), [#linux](https://daily.dev/tags/linux) [View this post on daily.dev](https://daily.dev/posts/tryhackme-guided-pentest-infrastructure-full-walkthrough-d3y3lmysw)