DEV Community

Cover image for Advent of Cyber 2025: Day 1 Writeup & SideQuest | TryHackMe

Advent of Cyber 2025: Day 1 Writeup & SideQuest | TryHackMe

Mahin Ahmad on December 02, 2025

Another year has passed by 🍁 autumn leaves are beginning to... leave :) and whatever cringe poetry Shakespeare did or did not say! Advent of Cyber...
Collapse
 
cta0930 profile image
spectr1 • Edited

I’m not giving a hint but let’s say you take a random .png and convert it to base64 -> copy the lengthy encoded string and then step back to root and paste the contents to the web directory that is served -> convert from base64 back to .png -> navigate to the original site url + /.png…viewable from the web. Second option and much faster…move it to /tmp as the user with ownership over whatever directory said file is located in then su to root and mv to served directory (that’d be whatever directory may or may not have something like index.html within it for those of you operating in cli only.

Collapse
 
muhammad_talhaidrees_ce4 profile image
Muhammad Talha Idrees • Edited

"And finally, write down the message you see."

I'm not sure about it...
could plz give a hint like how to deal with the sq1.png

Collapse
 
mahin101 profile image
Mahin Ahmad • Edited

Oh, I meant when you open the picture file (like you normally do in your laptop), you will "see" the text. And by "write down" I just meant save the text you "see" in the picture in a notepad or whatever, in case you want to try the SideQuest.

Collapse
 
muhammad_talhaidrees_ce4 profile image
Muhammad Talha Idrees • Edited

when i open it using xdg-open, it shows a pixeleted image in cacaview (egg shaped when zooming out)

Thread Thread
 
mahin101 profile image
Mahin Ahmad • Edited

I was using the VM box from the tryhackme webpage; that is a GUI ubuntu environment.
What are you using? I think you are using a pure cli environment (e.g. ssh from windows terminal?). Or the only 'photo viewer app' available in your system is _cacaview _

You said "egg shaped when zooming out". Can you zoom out a bit more? you are very close, focus on the lower part of the image.
_cacaview _uses ascii characters to 'build' the image, its ~impossible to see writings in pictures. Use a different environment.

Thread Thread
 
muhammad_talhaidrees_ce4 profile image
Muhammad Talha Idrees

im using the machine provided with the Day 1 challenge (- -).

Thread Thread
 
mahin101 profile image
Mahin Ahmad

I gotta say, it is strange. I opened day01 machine again to check further

  1. I logged in as eddi and used xdg-open, it doesn't work, needs sudo. And sudo wont work on eddi user.
  2. I used caraview as eddi user, the image opened in the caraview. But you said you used xdg-open and it used caraview internally. Did you try using xdg-open from eddi user or mcskidy ?
  3. As my understanding it is not possible to open the image from eddi due to permission issue, using sudo throws error "eddi is not in the list". So exit from eddi bash session to go back to mcskidy, then do an elaborate copy command to bring in the image from /home/eddi/pic(you wont have autocomplete feature). Then use xdg-open, you will hit permission issue again, then use sudo, this time it will work because you are mcskidy now.

Another way is to use the GUI file explorer, but it opens /home/ubuntu, not /home/eddi. You have perform the copy operation to bring the image from eddi's to /home/ubuntu but in this case also you gotta have sudo priv like mcskidy :)

Thats All the support I can give!
If you inherently have issues with xdg-open or cacaview is not moving its cha-cha(i dont know what this means, dont sue me><), then use eom . It is the command tool for the actual photo view app "Eye of MATE"

Thread Thread
 
muhammad_talhaidrees_ce4 profile image
Muhammad Talha Idrees

got it, thanks bro

Collapse
 
arumannn profile image
Arumannn

so the last flag "see" it just only keep for later? i thought is a flag for something

Collapse
 
nguyn_khnh_4f7b3c010b21 profile image
Nguyα»…n KhΓ‘nh

You can open sq1.png by xdg-open to see the memory key, or you can download it to your machine and then open it.

Collapse
 
zaid_d25c2a755771c1b86149 profile image
Zaid

I tried the invitation code with the text that i see in the final image on this link dvent-of-cyber-2025-day-1-writeup-sidequest-tryhackme-2l34 but it doesnΒ΄t work. Did i miss something?

Collapse
 
mahin101 profile image
Mahin Ahmad • Edited

Dont say it doesn't work. Instead say: I did this and this; then this message showed... or nothing showed.
In the SideQuest room 'The Great Disappearing Act', whats the next thing you did after starting the TargetBox? In fact you did not mention where you inserted the message. Did you go to the address specified in the Task?
(you are not supposed get any flag after putting that text in there, that would be too easy. I'm yet to finish my writeup on that SideQuest due to.... time-crunch!)

Collapse
 
zaid_d25c2a755771c1b86149 profile image
Zaid

Sorry english it's not my first language. I managed to decipher the image as you indicated; there's text at the bottom. Is that the invitation code?

Collapse
 
cta0930 profile image
spectr1 • Edited

Zaid: Wrong area to insert key for SQ1. The first Side Quest stocking takes an invitation code. Like Mahin said, the great disappearing act is where you will need to input the text from the sql.png.

Collapse
 
mahin101 profile image
Mahin Ahmad

Wdym by 'stocking 2nd from the left' ?
(don't reveal anything, I am behind schedule to solve the rooms, will post as soon as I do)

Thread Thread
 
cta0930 profile image
spectr1

How far along are you so far? I'm caught up on all the regular challenges and have been working the side quests.