TryHackMe Writeup

Checkmate | TryHackMe CTF Writeup

Exploiting Weak Password Patterns Using Hydra, CeWL, CUPP, Hashcat, and Crunch

Access Room: https://tryhackme.com/room/checkmate

TryHackMe

Challenge Overview

The Checkmate room focuses on assessing weak password practices within a simulated corporate environment. Marco Bianchi, a systems administrator, recently deployed multiple internal services, including a firewall console, employee portal, social platform, and SSH access to critical infrastructure. Due to poor password hygiene and operational pressure, Marco reused weak, predictable, and pattern-based passwords across different systems.

The challenge demonstrates how attackers can progressively compromise services by leveraging default credentials, OSINT, custom wordlists, password profiling, hash cracking, and predictable password generation patterns. Rather than relying on software vulnerabilities or advanced exploitation, the room emphasizes realistic password attacks that are commonly seen during internal penetration tests and red-team engagements.

Throughout the assessment, we use several offensive security tools such as Hydra, CeWL, CUPP, Crunch, and Hashcat to identify weaknesses in Marco’s authentication strategy and gain access to increasingly sensitive services.

Objectives

• Exploit weak and default credentials across multiple services.
• Generate custom password wordlists using OSINT and company keywords.
• Perform brute-force attacks against web login portals and SSH.
• Analyze predictable password creation patterns.

Walkthrough

To begin the challenge, I first launched the target machine instance from the TryHackMe room dashboard. After a few moments, the platform assigned a target IP address that would host all the vulnerable services used throughout the room.

First, I accessed the main application at: http://<TARGET_IP>:5000/

Then I configured static host mapping to enable access to the target’s virtual hosts and edited the local /etc/hosts file and appended the following entry:

<TARGET_IP> firewall.thm jobs.thm social.thm

I used the following command to edit the hosts file:

echo "10.48.129.160 firewall.thm jobs.thm social.thm" | sudo tee -a /etc/hosts

Purpose: To allow local browser and command-line tools to interact with unique applications hosted on the same server via Virtual Host (VHost) routing.

By configuring local hostname resolution:

• firewall.thm points to the firewall application
• jobs.thm points to the employee portal
• social.thm points to the social platform

LEVEL 1

Marco deployed a firewall at firewall.thm:5001 but kept default credentials.

The first challenge involves a firewall management console running on firewall.thm:5001. The room description hints that Marco deployed the firewall but forgot to change the default credentials.

firewall.thm

After opening the login page in the browser, I inspected the authentication request using the browser’s Developer Tools. Using the Network Tab, I performed a failed login attempt and analyzed the request and response.

From the captured request, I identified:

• Request Method: POST
• Login Endpoint: /login
• Parameters: username, password
• Failure Message: Invalid credentials.

This information is critical because Hydra requires the login endpoint, POST parameters, and a failure condition string.

Since the challenge explicitly mentions default credentials, I used the default password wordlist from SecLists.

Command:

hydra -l admin \
  -P seclists/Passwords/Default-Credentials/default-passwords.txt \
  -f -V -t4 \
  -s 5001 \
  firewall.thm http-post-form \
  "/login:username=^USER^&password=^PASS^:Invalid credentials."

• -l admin: Username to test
• -P: Password wordlist
• -f: Stop after finding valid credentials
• -V: Verbose output
• -t4: Use 4 parallel tasks
• -s 5001: Target port
• http-post-form: Hydra module for POST authentication

Hydra HTTP-POST-Form Arguments:

”/login:username=^USER^&password=^PASS^:Invalid credentials.”

• Login Path (/login): The page responsible for authentication.
• Body Payload (username=^USER^&password=^PASS^): Hydra dynamically replaces ^USER^&^PASS^with supplied values during the attack.
• Failure Condition (Invalid credentials.): Hydra checks every response for this string. If the string disappears, Hydra identifies the login as successful.

After several attempts, Hydra successfully identified the valid administrative password for the firewall console.

Using the credentials, I gained access to the internal firewall application.

firewall.thm

LEVEL 2

Marco built an internal Employee Login panel on jobs.thm:5002 and used common company keywords as passwords.

The next target is an employee login portal hosted on jobs.thm:5002. The description hints that Marco used common company-related keywords as his password.

To extract meaningful keywords from the application, I used CeWL. CeWL is a web crawler that scrapes words from websites and builds custom wordlists useful for password attacks.

Command:

cewl -d 2 -m 6 --lowercase -w keywords.txt http://jobs.thm:5002

• -d 2: Crawl depth of 2.
• -m 6: Minimum word length.
• --lowercase: Convert words to lowercase.
• -w keywords.txt: Save output to file.

After generating the wordlist, I launched another Hydra attack targeting the user marco.

Command:

hydra -l marco \
  -P keywords.txt \
  -f -V -t4 \
  -s 5002 \
  jobs.thm http-post-form \
  "/login:username=^USER^&password=^PASS^:Invalid credentials."

Hydra iterated through the generated keywords and eventually identified the correct password.

Using Marco’s credentials, I logged into his employee account:

jobs.thm

Here we got some personal info about Marco:

• Full Name: Marco Bianchi
• Nickname: marky
• Birthdate: 14/02/1995

LEVEL 3

Navigate to social.thm:5003 and derive Marco’s password from personal info.

Previously, in LEVEL 2, we got some information about Marco; this information can be weaponized to generate highly targeted passwords.

I used that info to create a custom wordlist using **CUPP**:

git clone https://github.com/Mebus/cupp.git
cd cupp

To run CUPP in interactive mode, we have to use -i flag:

python3 cupp.py -i

We will put the following things to generate our wordlist:

• First Name: Marco
• Surname: Bianchi
• Nickname: marky
• Birthdate (DDMMYYYY): 14021995

For other input fields, I just skipped, and used the following tweaks:

After generating the wordlist, I launched another Hydra attack targeting the user marco on social.thm app:

hydra -l marco \
  -P /Downloads/cupp/marco.txt \
  -f -V -t4 \
  -s 5003 \
  social.thm http-post-form \
  "/login:username=^USER^&password=^PASS^:Invalid credentials."

After a while, Hydra identified the correct one.

Now that I have those credentials, I can finally log in to Marco's social profile.

social.thm

LEVEL 4

On social.thm:5003, Marco recently uploaded a new profile picture. For privacy and storage consistency, the platform automatically renames uploaded files to the SHA256 hash of the original filename and saves them in the format (SHA256).png. Your task is to identify the original filename of Marco’s uploaded profile picture. Submit only the filename to proceed.

After logging into Marco’s account, I inspected the profile image using page source.

There I found the SHA256-hashed filename:

d34a569ab7aaa54dacd715ae64953455d86b768846cd0085ef4e9e7471489b7b.png

First, I saved the SHA-256 hash into a file named hash.txt:

echo "d34a569ab7aaa54dacd715ae64953455d86b768846cd0085ef4e9e7471489b7b" > hash.txt

Next, I used Hashcat to crack the hash using the popular rockyou.txt wordlist:

hashcat -m 1400 hash.txt /usr/share/wordlists/rockyou.txt

After a while, Hashcat finally managed to crack the SHA-256 hash.

LEVEL 5

Marco has revealed his password pattern on social.thm:5003, using predictable rules based on keywords and formatting. Use this information to generate a targeted wordlist and brute-force the SSH service with username marco.

Marco revealed his password-generation methodology publicly on the social platform.

social.thm

Marco posted:

“My tip for strong passsord: I take a company keyword, capitalize it, then append the year like 2024 or any other number and an exclamation mark.”

Keywords: security, excellence, innovation, digital, cloud.

From the observed pattern, it was clear that the passwords likely included year-based values (20XX) along with common organizational keywords. To leverage this insight, I focused on generating all possible combinations of these keywords paired with year numbers.

So, I used Crunch to create a custom wordlist based on the password pattern Marco generally uses:

crunch 13 13 0123456789! -t Security20%%! > passlist.txt; \
crunch 15 15 0123456789! -t Excellence20%%! >> passlist.txt; \
crunch 15 15 0123456789! -t Innovation20%%! >> passlist.txt; \
crunch 12 12 0123456789! -t Digital20%%! >> passlist.txt; \
crunch 10 10 0123456789! -t Cloud20%%! >> passlist.txt

crunch [min] [max] [charset]: Generates passwords with a fixed length using the specified character set.

-t [pattern]: Defines a custom structure for password generation:

[pattern]→Security20%%!

• Security → fixed keyword
• 20 → ensures a year-like prefix
• %% → two variable digits (00–99)
• ! → common special character at the end

> → Creates/overwrites passlist.txt (first command)

>> → Appends results to the same file (subsequent commands)

After generating the targeted wordlist, I used Hydra against the SSH service.

hydra -l marco \
  -P passlist.txt \
  -f -V -t4 \
  10.48.129.160 ssh

After a while, Hydra successfully identified the SSH password. This granted access to the final service, completing the challenge.

Answer the questions

What is the password for Level 1?

Answer. *****

What is the password for Level 2?

Answer. **********

What is the password for Level 3?

Answer. ***********

What is the password for Level 4?

Answer. ******

What is the password for Level 5?

Answer. *************

Key Takeaways

The Checkmate room highlights how weak password practices can completely undermine the security of an environment, even when multiple services are deployed correctly. Throughout the challenge, every level relied on predictable human behavior rather than advanced exploitation techniques. Default credentials, company-related keywords, personal information, and repeated password patterns all became effective attack vectors that enabled the progressive compromise of various systems.

One of the most important lessons from this room is how dangerous targeted wordlists can be. Tools like Hydra, CeWL, CUPP, Crunch, and Hashcat become extremely powerful when combined with publicly available information and predictable password habits.

The challenge also demonstrates the importance of operational security and password hygiene. Reusing similar password structures across applications creates a domino effect where compromising one service can help attackers gain access to others. Ultimately, Checkmate serves as a realistic reminder that human-generated passwords are often the weakest link in modern infrastructure security.