Room 404 — TryHackMe Walthrough

Room 404 is the Day 2 of TryHackMe’s Hacker Holidays 2026 event, set at the fictional Byte Lotus Hotel. The scenario centers on the hotel’s guest-experience web platform that went live in a hurry, and the night-shift developer shipped more than the website, exposed on port 8080. He booked the quiet room that isn’t on the floor plan, not in the brochure, not on any door.

The challenge revolves around basic web reconnaissance — enumerating exposed source code and hidden directories to uncover a hidden flag that was never meant to be publicly accessible.

Step 1 — Directory Enumeration

Ran a quick web scan with dirb to display hidden files and directories.

dirb http://10.48.174.245:8080

Out of 4600+ words scanned, only one thing came back:

http://10.48.174.245:8080/.git/HEAD

An exposed .git/HEAD means the entire git repository — including source code and commit history — is sitting on the web server, publicly readable.

Step 2 — Confirming the .git Exposure

Running this file in the browser showed:

ref: refs/heads/main

This tells Git that the current branch is main. Followed the ref on the main branch in the browser.

Verfied the results from the terminal using curl:

curl http://10.48.174.245:8080/.git/refs/heads/main

Also checked if directory listing was on for .git/ itself, just to see the extent of the exposure — and it was.

HEAD, config, logs, objects — the entire repo is exposed. This is not just a partial ref leak, the entire data is browsable and publicly accessible.

Step 3 — Dumping the Repository

Since the entire repo is directly accesible, the fastest approach is to reconstruct the entire repository using git-dumper instead of manually downloading objects.

git-dumper http://10.48.174.245:8080/.git git

Once finished, I started digging through the source, entered the repository and listed the files —

cd git
ls

Step 4 — Retrieving the Flag

Out of the discovered files, I went to README.md first instinctively, since that is where developers tend to store their internal notes.

cat README.md

And it worked! Someone pushed it live with the .git/ folder intact and the flag still sitting in plaintext right there in the README.