TryHackMe | Anthem Writeup

TryHackMe’s Anthem room is an easy room that focuses on website analysis, credential guessing, and file properties to get root on a Windows machine. This writeup will go through each step required to find everything in the room and get root.

Task 1: Website Analysis

1. Run nmap and check what ports are open. Let’s start the target machine and connect ourselves to the TryHackMe network. We’ll start the machine by clicking the green “Start Machine” button at the top of the task. I’m using a Kali virtual machine so I’ll connect to TryHackMe through OpenVPN.

Starting the target machine

Now that we’re connected, let’s do an nmap scan. We’ll use the service flag (sV) and the very verbose flag (vv) in the scan. The following will be the full command.

nmap -sV -vv 10.10.176.39

This gives us two open ports, 80 and 3389.

Results of the nmap scan

2. What port is for the web server? This should be an easy question based on the nmap scan. If you are completely new to ports and are unsure of what the answer is read through this article for help.

3. What port is for remote desktop service? Again, based on the nmap scan this should be simple. If you need help with understanding what port this could be here is another article to help.

4. What is a possible password in one of the pages web crawlers check for? Websites commonly have a robots.txt file that a web crawler checks to see what they are allowed to index for websites. It’s commonly used to avoid having crawlers bombard your site with requests or crawling through unnecessary pages. For a better explanation, Google has an introductory article for it.

Let’s go to the robots.txt page on the website to see what is there.

Results in the robots.txt file

The first line gives us the possible password.

5. What CMS is the website using? We can navigate to the other directories to find the name of the CMS.

6. What is the domain of the website? If we travel to /umbraco_client/ the name of the website is at the top of the page.

Finding the name of the blog

7. What’s the name of the Administrator There is blog entry titled “A cheers to our IT department” which has a poem about the administrator. The poem is an old nursery rhyme and if we google the lyrics we are given the name of the poem, which is the name of the administrator.

Poem about the administrator

8. Can we find the email address of the administrator? We can’t directly find the email of the administrator, but we can make an educated guess. There is another entry titled “We are hiring” by a person named Jane Doe. At the end of the entry, they list their email, which is their initials and the website. We can assume that the naming conventions for the email addresses follow this pattern.

Finding the naming conventions of the email addresses

Now that we have all the information we need, we can move onto the next task.

Task 2: Spot the flags

1. What is flag 1? We have the administrator credentials so let’s login as them on the CMS admin page. We kind of have to read the hints for these since they’re so vague. The first hint tells us to inspect the pages, we can go to Content>Blog>Archive>We are hiring>Meta Tags to find the flag in the social description of the tags.

Finding the first flag in the meta tags

2. What is flag 2? The hint for this flag is to search for it. If we go to the original website and inspect the element in the search bar, we can find the flag hidden in the box.

Finding the second flag in the search bar

3. What is flag 3? Flag 3 tells us that it’s in a profile. In the CMS console there is only one author, Jane Doe. We can look at her author info and find the flag in the author Url.

Finding the third flag in Jane Doe’s profile

4. What is flag 4? Flag 4 asks us if we’ve inspected all of the pages yet. We can go back to the post archive and look at the “A cheers to our IT department” entry. Like for the first flag, we can look in the Meta Tags section for the flag.

Finding the fourth flag

Task 3: Final stage

1. Let’s figure out the username and password to log in to the box. If we remember all the way back to the first task, we found a username and password of the administrator for the CMS. We’re told that the box is not on a domain so the credentials are probably the initials and the password.

We also know that the machine has RDP available, so let’s use remmina to access the machine through RDP. When we enter the initials and password of the CMS administrator, we’re logged in.

Logged in as the CMS admin

2. Gain initial access to the machine, what is the contents of user.txt? We can simply open the user text document that is on the desktop.

Getting the user flag

3. Can we spot the admin password? We’re told that the password is hidden on the machine. We can open File Explorer and go to File>Change folder and search options>View>Show hidden files, folders, and drives>Apply>OK to allow ourselves to view hidden files.

Now that we can see hidden files, we can see a backup folder in the C drive with a file called “restore”. If we try to open the file, we are given an error saying that we don’t have permission to open it.

Cannot open restore.txt

Let’s take a look at the security properties for the file.

Security properties of restore.txt

Nobody is allowed to access the file, we can try to edit the permissions. Let’s add everyone to the permissions so that we can open it.

Changing file permissions to Everyone

Now we can click OK to apply these settings. Let’s give everyone full control on the document so we can get the password.

Getting the administrator’s password

4. Escalate your privileges to root, what is the contents of root.txt? Let’s disconnect RDP on this user and login as administrator with the password we found.

Logging in as administrator

Once we’re logged in, we are greeted with the desktop that has the root flag. Let’s open it and submit the flag.

Getting the root flag

We’ve completed the room! We went from an initial scan to full root access through website analysis, credential guessing, and changing file properties. I hope this writeup could be helpful in completing the room! If you are still struggling please leave a comment or message me on Twitter and I will try my best to assist!

Lessons Learned:

• Finding one user’s credentials can be used to guess the format of another’s
• File Explorer settings can hide files
• File properties can be changed to read files

Things I struggled with:

I took a break between task 1 and 2 and forgot I had login credentials so I was looking for the flags on the base website. I was able to find three but couldn’t find the last until I logged into the admin console. When task 3 said the admin password was hidden I assumed it meant it was buried in a file somewhere so I started searching. I had to Google a bit to find out how to allow myself to see them.

Conclusion:

I thought this room was pretty good. I wish on task 2 it specified what flag was which since I disliked having to use the hints for more context. Other than that I thought the room was set up well and flowed together nicely. I would recommend this room to someone who wants to practice finding information on websites.