THM - Hammer

A writeup for the room Hammer on TryHackMe

Use your exploitation skills to bypass authentication mechanisms on a website and get RCE.

https://tryhackme.com/room/hammer

Footprinting

We can start by doing a scan with nmap.

nmap -sS -p- MACHINE_IP

We found two open ports: 22 and 1337.

On port 1337 we can only see a login page.

What is the flag value after logging in to the dashboard?

Searching for a possible user

Looking at the source code of the login page, we can see a comment about the directory naming convention.

We can run a scan using ffuf with hmr_ prepended to the folder name.

ffuf -w /usr/share/wordlists/dirbuster/directory-list-2.3-medium.txt \
  -u http://MACHINE_IP:1337/hmr_FUZZ

We found the logs folder, which looks interesting.