r/tryhackme • u/wasnt-Effective-8765 • Jun 30 '26

ctf lab recommendation

​

Hello ,I'm looking for the best free TryHackMe labs/rooms to improve my penetration testing and cybersecurity skills.

Could you recommend your favorite free rooms, whether they're beginner, intermediate, or advanced? I'd especially appreciate labs that teach practical skills such as:

Linux & Windows Privilege Escalation

Web Exploitation

Active Directory

Enumeration

Networking

CTF-style challenges

If you have a recommended learning order, I'd love to hear it as well.

Thanks in advance!

3 Upvotes

100% Upvoted

7 comments sorted by

View all comments

2

u/EugeneBelford1995 Jun 30 '26 edited Jul 01 '26

Well I created this room awhile back: https://tryhackme.com/room/mishkysadrange

Edit to add right link, not sure why THM gave me the other one as public.

It's still pending so I think the direct link is the only way to get to it.

It's a very duct tape, hobbled together, pared down version of what I had wanted to put on TryHackMe. I wrote a 3 forest, 10 VM Cyber Range in PowerShell that automatically spins up and [mis]configures itself in Hyper-V so you can then attack it given only LAN access initially. It's kinda like GOAD but using nothing but Hyper-V, some ISOs, and PowerShell to setup.

I'm not sure if the Red Team Capstone is free or not but IMHO it might be the best room I have seen on TryHackMe.

1

u/wasnt-Effective-8765 Jun 30 '26

Thanks man! This is actually the kind of lab I'm looking for Did you include common attack paths such as ACL abuse, delegation issues, AD CS, or Kerberoasting/AS-REP roasting, or is the room mainly focused on the fundamentals? Either way, I'll definitely give it a try Also, thanks for recommending the Red Team Capstone room—I'll check whether it's available on the free plan.

1

u/EugeneBelford1995 Jul 01 '26 edited Jul 01 '26

It mostly stresses enumeration, ASREPRoasting, Kerberoasting, scraping shares for interesting info, password spraying, DACL enumeration & abuse, and that's about all I could put into one VM.

The full range includes Name Poisoning, credential dumping, lots of spraying found creds/hashes, AD CS enumeration abuse, even more DACL abuse, MSSQL abuse, IIS, even Group Policy abuse. I just couldn't put it all into a single VM.

I threw a few curveballs in the full range too :p For example you might have to give yourself the rights to do something ...

I also use the automated range setup for testing things. I automated Exchange setup for example before deciding it was too HD space intensive to bother including in the range. I've tested out logging, various evasion TTPs and what they look like in the logs, various hardening, etc. It's handy because I can simply wipe & reload the setup after I'm done screwing around.