Summary
TryHackMe: Room 404 Walkthrough (Hacker’s Holiday Challenge) Difficulty: Very Easy Category: Web / Information Disclosure Target Room: https://tryhackme.com/room/hh-room404-804573bf Executive Summary During web application security assessments, misconfigurations in version control systems can lead to catastrophic source code disclosure. In this challenge, an exposed .git directory allowed us to reconstruct the target application’s entire source code repository offline and extract sensitive internal staging notes. Initial Reconnaissance & Thought Process When spinning up the target machine on port 8080, the room description provided a vital clue: “The Byte Lotus guest-experience platform went live in a hurry, and the night-shift developer shipped more than the website.”
- The Automated Fuzzing Trap My initial approach was running automated directory brute-forcing tools like dirsearch . While automated fuzzing is standard practice, wordlists can be large, slow, or noisy depending on the target’s response times. After spending time waiting on full directory scans, I paused to review the room’s core task hints:
- Directory Enumeration
- Dump the exposed source code
- Manual Source Code Enumeration Instead of waiting on deep wordlist fuzzing, I switched to manual testing for common source control folders that developers often forget to restrict access to: /.git/ /.svn/ /.env /.hg/ Navigating directly to http://<TARGET_IP>:8080/.git/ confirmed the vulnerability: Directory listing was enabled, revealing the internal Git repository structure. Navigating Standard Git Objects Browsing raw .git folders manually can be confusing at first because Git stores its repository data in compressed binary objects (zlib ). When inspecting files inside .git/HEAD , .git/refs/heads/main , or .git/objects/ , you will often see raw SHA-1 hashes or compressed binary data rather than plaintext files: file index index: Git index, version 2, 3 entries While you can manually decompress individual objects using Python’s zlib library or native git cat-file commands, doing this object-by-object across a web server is inefficient. Exploitation: Reconstructing the Repository with git-dumper To dump the full source code structure automatically, we use git-dumper —an automated tool that recursively fetches accessible Git internal files (index , HEAD , objects , refs ) over HTTP and reconstructs a working local repository. Step 1: Tool Execution Execute git-dumper against the target’s exposed .git/ endpoint: python3 -m git_dumper http://<TARGET_IP>:8080/.git/ dumped_repo (Or directly : git-dumper http://<TARGET_IP>:8080/.git/ dumped_repo ) Step 2: Source Code Analysis Once git-dumper finishes downloading and extracting the objects, navigate into the output directory: cd dumped_repo ls -la We can now see the entire reconstructed workspace: app.js — Front-end guest app JavaScript code.index.html — Main landing page interface.README.md — Internal staging documentation. Retrieving the Flag Checking the contents of README.md reveals internal notes left behind by the developer prior to staging: cat README.md
Byte Lotus — Guest Experience Platform
Internal staging repository for the guest app and concierge personalization service. Do not deploy this folder to production.Staging flag (remove before launch): THM{************************} Submit the Flag and earn a raffle ticket . The End . Happy Hacker’s Holiday