HH2026 - 02 - Room 404

TryHackMe’s HackerHotel 2026 Event

This writeup is part of a series going through TryHackMe’s 2026 14-day Hacker Holidays daily challenge event

Background & Info from the Challenge Page

This section was copied from the Day 2 challenge page on THM.

This challenge was rated as Very Easy.

The category was Web and the associated tags were:

• Web
• Directory Enumeration

Concierge Briefing

He booked the quiet room. It’s not on the floor plan, not in the brochure, not on any door. But port 8080 is wide open, and the rooms it never lists are the ones worth finding.

Welcome to the Byte Lotus, where the WiFi is open, the app is free, and the concierge already knows your coffee order. You spend these first days as a guest who simply notices things — a room that isn’t on the floor plan, packets that leave every night at the same hour, a profile assembled from two breakfasts and a livestream.

The Byte Lotus guest-experience platform went live in a hurry, and the night-shift developer shipped more than the website.

Today’s Itinerary - Goals

• Dump the exposed source code.
• Find the flag.

Room Access

• The THM attack box (to work from and access the lab machine)
• A lab machine at http://MACHINE_IP:8080

Writeup

The main hint for this one, bolded above, was the fact that port 8080 was “wide open”. As this was rated Very Easy, I again tried not to overthink it and try the dumb or obvious stuff first.

I visit the URL (including port) in the browser to be greeted by a simple page. The Booking button leads to a 404 page. No other button or link is functional.

I view source to see confirm whether there’s anything more not visible to the eye, mainly javascript. Verdict: nothing.

Directory Enumeration

Seeing as the tag was Directory Enumeration, the next natural steps are to try to do just that. There are many ways to try to do this and the most inefficient is doing it manually. Which is what I did at first. Very Easy, remember?

I tried to reach places like .env, .bak, /admin, /config, etc.

And then I tried .git and it yielded something:

A more efficient way than guessing would have been a quick nmap -sCV. That would have shown me the open ports 22 (ssh) and 8080, which we already knew about in this case. The default scripts in -sC include one called http-git that checks for exposed git repos, so I would have found the /.git/ directory that way too.

Regardless, we have a reachable .git/ directory like this is a big deal and would most likely help with finding the flag.

At this point, we could enumerate manually and wget the full git directory’s contents. But there are better tools.

Solution

I ended up using a tool called git-dumper which is specifically made for dealing with exposed git dirs and dumping them locally.

root@ip-10-65-116-30:~# git-dumper http://10.65.159.123:8080/.git/ ./goodies
[-] Testing http://10.65.159.123:8080/.git/HEAD [200]
[-] Testing http://10.65.159.123:8080/.git/ [200]
[-] Fetching .git recursively
[-] Fetching http://10.65.159.123:8080/.git/ [200]
[-] Fetching http://10.65.159.123:8080/.gitignore [404]
[-] http://10.65.159.123:8080/.gitignore responded with status code 404
[-] Fetching http://10.65.159.123:8080/.git/branches/ [200]
[-] Fetching http://10.65.159.123:8080/.git/config [200]
[-] Fetching http://10.65.159.123:8080/.git/COMMIT_EDITMSG [200]
[-] Fetching http://10.65.159.123:8080/.git/refs/ [200]
[-] Fetching http://10.65.159.123:8080/.git/logs/ [200]
[-] Fetching http://10.65.159.123:8080/.git/HEAD [200]
[-] Fetching http://10.65.159.123:8080/.git/index [200]
[-] Fetching http://10.65.159.123:8080/.git/description [200]
[-] Fetching http://10.65.159.123:8080/.git/refs/heads/ [200]

...

[-] Running git checkout .
Updated 3 paths from the index

Once the git repo was dumped locally, my first thought was to scavenge the git commit history to find out whether the flag was left somewhere in old commits. However, I opened the README.md first and that cut to the chase because the flag was in there.

~/goodies# ls
README.md  app.js  index.html

~/goodies# cat README.md
# Byte Lotus - Guest Experience Platform

# Internal staging repository for the guest app and concierge personalization service.
# Do not deploy this folder to production.

# Staging flag (remove before launch): THM{REDACTED_FLAG}

Got em.

Kill-Chain

1. Prod the target’s open port for exposed directories
2. Find .git/ and dump the contents
3. Read the flag from the README.md