TryHackMe Room 404 Writeup: Complete Walkthrough of the Byte Lotus Hotel Challenge

Hey everyone! 👋 Welcome back to another TryHackMe write-up. In this write-up, we'll explore Room 404, a mystery-themed challenge from the Hacker Holidays series set in the fictional Byte Lotus Hotel. This room is designed to test your observation, enumeration, and problem-solving skills through a series of hidden clues and engaging tasks.

Throughout this write-up, we'll walk through the challenge step by step, covering the methodology, tools, and techniques used to solve each task.

Room link: https://tryhackme.com/room/hh-room404-804573bf

Task #1:

Navigate to the URL.

But in here, we didn't get anything interesting. So, let's try…

Discovering Hidden Directories with DIRB:

To scan the target web server for hidden endpoints, we deploy dirb (a URL analysis and directory brute-forcing tool). The scan targets port 8080 using a default wordlist to systematically fuzz the web root.

The server returns an HTTP 200 OK status code for the /.git/HEAD path, indicating that the internal .git repository folder is exposed to the public internet. Now navigate the .git directory.

After navigating, we have gotten some directories. Our reconnaissance phase successfully confirmed a high-severity security misconfiguration: Exposed Version Control Infrastructure. Rather than standard web pages, the web root leaks internal development repository contents.

Our Next Tactical Steps:

Install specialized tooling to pull down the repository components systematically.
Dump the full .git configuration and object history from the remote target server.
Reconstruct the local project workspace to restore deleted files, commit histories, and source code assets.

For this we will use the git-dumper utility to download and reconstruct a remote repository from an exposed /.git/ directory, allowing for local analysis of the source code. The process involves installing the tool, executing the dump command, and navigating the reconstructed directory to expose the application's underlying files and history.

Executing the Git Dump

To systematically scrape the remote .git folder and reconstruct the directory structure, execute git-dumper against the target URL. The tool automatically fetches index files, commits, and refs, placing them into a designated local directory.

Navigate the dumped repo directory.

 cd dumped_repo
$ ls
app.js  index.html  README.md

 cd dumped_repo
$ ls
app.js  index.html  README.md

The workspace contains standard web assets, project configuration details, and development documentation:

index.html — The main landing page configuration.
/js — Directories hosting front-end scripting utilities.
README.md — The internal staging guide and deployment notes documentation.

Analyzing Project History and Documentation

Exposed repositories frequently contain sensitive data within past development logs or documentation files. To check for embedded credentials or flags, inspect the contents of the newly recovered README.md file using a standard terminal viewer:

$ cat README.md
# Byte Lotus — Guest Experience Platform

Internal staging repository for the guest app and concierge personalization
service. Do not deploy this folder to production.

Staging flag (remove before launch): THM{****_*****_*****_*******}

$ cat README.md
# Byte Lotus — Guest Experience Platform

Internal staging repository for the guest app and concierge personalization
service. Do not deploy this folder to production.

Staging flag (remove before launch): THM{****_*****_*****_*******}

Our exploitation phase successfully recovered the flag for this challenge.

So far we have learned that exposed Git repositories on production servers facilitate the reconstruction of application architectures, allowing for the extraction of sensitive data like the THM{...} flag from documentation files. Implementing strict server access controls to block public access to hidden directories is critical to preventing such compromises.

If you enjoyed this write-up, consider following me (A. AntorCSE404) for more write-ups and CTF challenges, and feel free to leave feedback — I'd love to learn and improve!

Contents

Task #1:

If you enjoyed this write-up, consider following me (A. AntorCSE404) for more write-ups and CTF challenges, and feel free to leave feedback — I'd love to learn and improve!