THM Hacker Holidays 2026 Room 2: Room 404

Web, Directory Enumeration, Exposed Git Repo

Following the Byte Lotus Resort mystery, we have someone booking a "quiet room" that's not listed anywhere. From the last challenge, we know that vibe was the one staying in a self-proclaimed "quiet room". Perhaps they know something about port 8080 being wide open and what else was shipped with the guest experience platform.

We are given the following information:

• Scenario: He booked the quiet room. It's not on the floor plan, not in the brochure, not on any door. But port 8080 is wide open, and the rooms it never lists are the ones worth finding. The Byte Lotus guest-experience platform went live in a hurry, and the night-shift developer shipped more than the website.
• Category: Web
• Topic: Directory Enumeration

We are asked to complete the following itinerary:

• Dump the exposed source code.
• Find the flag.

Tools Used:

• Browser
• Developer Tools
• Linux Terminal
  - nmap
  - wget
  - git

Walkthrough:

I started up the lab machine and pasted the given IP address and port into a web browser on my attacker machine. This brought me to the homepage of the Byte Lotus Hotel; maybe something on the website shouldn't be there.

Byte Lotus Website

• Initial Trials:
  - Appending to and traversing /robots.txt in the browser returned nothing of value.
  - Next, I looked at the webpage's source code, which also showed nothing of interest except a /booking reference. This is the same reference used when clicking Reserve a stay, which results in a 404 Not Found error.
  - I decided to inspect the page and check the network and storage tab, but found nothing of interest.

Webpage Source Code

• A New Direction:
  - Looking back at the challenge briefing, there is a mention of finding exposed source code and an open port 8080.
  - I ran nmap on the lab machine and port to see what services or hidden directories could be present.
  - This returned a /.git directory and repository labeled as the Initial Byte Lotus Guest Platform.

nmap -sV -sC (Your lab machine IP) -p 8080

• Following this lead further, we can append /.git to the given IP address for the Byte Lotus Resort webpage in the browser.
  - We can see a lot of additional directories from this view. For easier viewing and navigation, I used wget to download the webpage's contents locally. (A tool that downloads and reconstructs Git repositories would have been better suited)

Get JinxedCyber’s stories in your inbox
Join Medium for free to get updates from this writer.
Remember me for faster sign in
wget -r http://(Lab machine IP):8080/.git/
ls -la
cd (lab machine ip:8080 folder)
ls -la
cd .git
tree
cat COMMIT_EDITMSG
cat /logs/HEAD

wget local download

• Following The Trail:
  - Parsing through the directories was manually intensive. It didn't show much interest, aside from confirming that this was the git repository for the Byte Lotus guest platform and that the night-shift developer made the commit.
  - Note: Filtering for strings for the flag and file extensions didn't return anything of value.

COMMIT_EDITMSG

/logs/HEAD commit

• Digging Deeper:
  - After some research and looking back at the briefing for the challenge, there was mention of rooms not listed that were the ones worth finding. Because we found the quiet room, which was the .git repository, I think there may be more to this repository than is being shown, specifically with previous COMMIT versions.
  - The challenge also mentions directory enumeration and that the night-shift developer may have shipped more than just the website; perhaps there are files or other directories that were previously hidden from normal navigation or in other commit versions that wget doesn't show.
• The Breakthrough:
  - Running git restore on the lab machine IP's directory reconstructed the repository, showing 3 files that were not present earlier.

git restore . (do this from the IP folder)
cat README.md
cat app.js
cat index.html

• The app.js file contained the front-end code for the guest app, with a TODO commit to wire it to the live webpage before the app's launch.
• The index.html file contained the same information we initially saw in the webpage's source code.
• The README.md file contained an internal staging repository for the guest app, not meant for deployment to production, as well as the flag!

The application code and flag!

Summary:

Utilizing nmap to enumerate the host revealed an exposed git repository directory listing on the front end. Reconstructing this repository revealed files that were never meant to be deployed or exposed to the public, granting us the flag. An exposed .git repository can enable attacks like these, leading to leaks of sensitive source code, commit history, or confidential data.

Mitigations:

• Restrict Access Control to .git on the web server
• Authentication for the night-shift developer
• Disable directory listings
• Auditing and monitoring

Lessons Learned:

• In the future, I think running a general enumeration of web challenges with NMAP as part of my process will be useful.
• Learning how to view the same information in the terminal as I see in developer tools and in a page's source code, using tools like curl, may help save time and improve efficiency when completing challenges.
• Utilizing tools that can more effectively fetch and reconstruct a git repository, such as git-dumper, dirb, ffuf, or gobuster, may aid in future challenges.

If this room interests you and you want to try it out for yourself, you can do so here: https://tryhackme.com/room/hh-room404-804573bf