TryHackMe |Anthem Walkthrough

A beginner-level windows CTF challenge.

This walkthrough is written as a part of the Master certificate in cybersecurity (Red Team) that I am pursuing from HackerU

Reconnaissance

Starting with an nmap scan .

nmap -sS -sV -A <IP>

Press enter or click to view image in full size

We discover 2 open ports 80 and 3389. There is port 80 open so it means there should a website.

Press enter or click to view image in full size

Press enter or click to view image in full size

Let’s see what the website has for us.

Press enter or click to view image in full size

We can find our first couple of flags just by looking through the pages and checking the page source. Along with that sets run dirbuster to find the web directories.

Checking robots.txt

Press enter or click to view image in full size

Here can have some juicy stuff and another flag.

Press enter or click to view image in full size

So we know UmbracoIsTheBest! is a possible password for some login

Press enter or click to view image in full size

What CMS is the website using?

Correct Answer: Umbraco

On one of the pages, we see this poem.

Press enter or click to view image in full size

On further googling, we find that the author of this poem is Solomon Grundy

Press enter or click to view image in full size

On one of the pages, we saw the email id of Author Jane Doe as JD@anthem.com

Press enter or click to view image in full size

So it made sense that the email id for Solomon grundy would be also SG@anthem.com

Get Onix.09’s stories in your inbox

Join Medium for free to get updates from this writer.

Remember me for faster sign in

Press enter or click to view image in full size

Checking the source code

http://<IP>/archive/we-are hiring/ > view source code

Press enter or click to view image in full size

Press enter or click to view image in full size

http://<IP>/archive/a-cheers-to-our-itdepartments/ > view source code

Press enter or click to view image in full size

Press enter or click to view image in full size

http://<IP>/authors/jane-doe/

Press enter or click to view image in full size

Press enter or click to view image in full size

http://<IP>/archive/a-cheers-to-our-it-departmenst/ > view source code

Press enter or click to view image in full size

Press enter or click to view image in full size

Finding the main flags

As we already know that we have a remote desktop port 3389 open, we use the already found credentials to log in.

Username — SG

Password — UmbracoIsTheBest!

rdesktop -u SG -p UmbracoIsTheBest! <IP>

Press enter or click to view image in full size

Press enter or click to view image in full size

Here we have our user flag.

Press enter or click to view image in full size

Press enter or click to view image in full size

Now our root flag is hidden. There is a backup folder that has the password required to access the Administrator folder. Enable hidden items folder to view it.

Press enter or click to view image in full size

Inside the backup folder, we have a restore.txt file that we do not have permission to open. For that, we need to change permissions for this file.

select restore.txt > Right click > properties > security > edit >type SG and click check nanes> ok>apply.

Press enter or click to view image in full size

Now we can easily open the file and see the admin password

Press enter or click to view image in full size

Using this we access the Administrator folder and get the root flag.

Press enter or click to view image in full size

And we finished the room, leaves some claps if you found this helpful.