Anthem ( tryhackme ) Write Up

Tony J -

About

Quick write-up on the Anthem box, not going to go into huge detail but should be enough for people to be able to complete it.

Link: https://tryhackme.com/room/anthem

This is my first write up, any comments or questions are welcome.

Thoughs

Although this box is listed as easy it can be hard and frustrating, it took me a couple of extensions to work my way through it. The flags in Task 2 cost a few points as it was not clear which flag was which.

[Task1] Website Analysis

The following are basic CTF bits, if you do not know how to use NMAP and the basic ports used by services / operating systems then I suggest you go do the Beginner Learning Path

  • Let's run nmap and check what ports are open.
  • What port is for the web server?
  • What port is for remote desktop service?

The below are bit more involved

  • What is a possible password in one of the pages web crawlers check for?

What files do crawlers look for on a website ?

  • What CMS is the website using?

You should be able to use the above file to find this

  • What is the domain of the website?

This can found in the title of the website

  • What's the name of the Administrator

This was a bit of PIA and took a while, few people have said the hint doesn't help. There is a post thanking the admin of the site which contains a poem, have a google of the poem.

  • Can we find find the email address of the administrator?

Again there is a post where another employee lists their email address, use this format with the name you found above

[Task2] Spot the flags

The flags are hidden in the source code of the website, some in the body text and some in the meta data.

  • What is flag 1?
  • What is flag 2?
  • What is flag 3?
  • What is flag 4?

[Task3] Final stage

  • Let's figure out the username and password to log in to the box.(The box is not on a domain)

This one took me longer than I'd like to admit but people re-use usernames and passwords. Users windows usernames are normally the first part of their emails in most orgs.

  • Gain initial access to the machine, what is the contents of user.txt?

This is on the users desktop when you log in via RDP/SMB using the credentials above.

  • Can we spot the admin password?

The file is in a hidden folder in the root of the C:\ drive, you will need to change the permissions of the file to read it though.

  • Escalate your privileges to root, what is the contents of root.txt?

Again this is on the desktop once you log in as the Administrator