Anthem
https://tryhackme.com/room/anthem
This task involves you, paying attention to details and finding the 'keys to the castle'.
This room is designed for beginners, however, everyone is welcomed to try it out!
Enjoy the Anthem.
In this room, you don't need to brute force any login page. Just your preferred browser and Remote Desktop.
Please give the box up to 5 minutes to boot and configure.
Enumeration
The poem in this blog post:
is a reference to the real name of IT Administrator:
Visiting the "We are hiring" page we find some useful information about a possible pattern for internal username and email company:
If we try to request sitemap.xml we obtain a strange error:
Going to endpoint /umbraco we obtain this one:
Umbraco is an open-source content management system (CMS) platform for publishing content on the World Wide Web and intranets. It is written in C# and deployed on Microsoft based infrastructure.
Try logging in using these credentials seems to work: SG@anthem.com UmbracoIsTheBest!
Searching in the source code of different web pages we can find the flags:
Try to RDPing using stolen credentials we can find on Desktop the user flag:
Info
WIN-LU09299160F
robots.txt:
Possible password:
UmbracoIsTheBest!Possible usernames:
Jane Doe,JD@anthem.comJames Orchard Halliwell,JOH@anthem.comSolomon Grundy,SG@anthem.com<- Administrator account
domain of website: anthem.com
IIS 10.0 Windows Server
Privilege Escalation
The hint on the the final task says the admin password is hidden somewhere. To see all hidden files and folders, I followed these steps first.
Open File Explorer from the taskbar.
Select the View tab. Go to Options, and select the Change folder and search options.
Select the View tab. In Advanced settings, select Show hidden files, folders, and drives.
Select Ok.
Now I could see a hidden folder named ‘backup’ in the C drive.
Inside the folder there’s a file named ‘restore’ which couldn’t be opened due to permission error.
But the funny thing is: I could alter the file permission from file properties.
Go to Properties>Security>Edit>Add and add your own username. Once added, click Ok. Then allow Full Control from the checkbox.
Now open the file and there is the password of Administrator.
With this password, connect to the host via remote desktop. There you’ll get your root flag.
Last updated
