Post cover image

October 15, 2026

Envizon (THM) Tryhackme Walkthrough Hard Challange

Description : Attacking the pentesters

By Lawvye

4 min read

Difficulty : Hard

Note : All of the content and images are from https://tryhackme.com/

Room : https://tryhackme.com/room/envizon

Enjoy.

Port Scanning :

PORT     STATE SERVICE  VERSION
22/tcp   open  ssh      OpenSSH 7.6p1 Ubuntu 4ubuntu0.3 (Ubuntu Linux; protocol 2.0)
| ssh-hostkey:
|   2048 cb:98:15:ed:13:41:b4:d5:53:72:53:54:c7:56:e6:6a (RSA)
|   256 c8:f2:71:60:0d:aa:f9:a0:d1:01:e5:61:30:97:ba:f7 (ECDSA)
|_  256 11:23:45:6f:40:7a:9c:e4:d4:f1:05:ac:45:d5:ff:1a (ED25519)
3000/tcp open  ssl/ppp?
|_ssl-date: TLS randomness does not represent time
| ssl-cert: Subject: commonName=None/organizationName=evait/stateOrProvinceName=None/countryName=DE
| Not valid before: 2020-09-30T22:19:49
|_Not valid after:  2021-09-30T22:19:49
| fingerprint-strings:
|   DNSVersionBindReqTCP, GenericLines, RPCCheck, RTSPRequest:
|     HTTP/1.1 400 Bad Request
|   GetRequest:
|     HTTP/1.0 301 Moved Permanently
|     Location: https://localhost/scans
|     Content-Type: text/html
|     Cache-Control: no-cache
|     X-Request-Id: 45309152-aaa1-40ae-823e-0b8e1699590b
|     X-Runtime: 0.003286
|     Strict-Transport-Security: max-age=31536000; includeSubDomains
|     Content-Length: 89
|     <html><body>You are being <a href="https://localhost/scans">redirected</a>.</body></html>
|   HTTPOptions:
|     HTTP/1.0 404 Not Found
|     Content-Type: text/html; charset=UTF-8
|     X-Request-Id: d41d5dda-8044-4cca-be48-90040fcb9c2c
|     X-Runtime: 0.001909
|     Strict-Transport-Security: max-age=31536000; includeSubDomains
|     Content-Length: 1722
|     <!DOCTYPE html>
|     <html>
|     <head>
|     <title>The page you were looking for doesn't exist (404)</title>
|     <meta name="viewport" content="width=device-width,initial-scale=1">
|     <style>
|     .rails-default-error-page {
|     background-color: #EFEFEF;
|     color: #2E2F30;
|     text-align: center;
|     font-family: arial, sans-serif;
|     margin: 0;
|     .rails-default-error-page div.dialog {
|     width: 95%;
|     max-width: 33em;
|     margin: 4em auto 0;
|     .rails-default-error-page div.dialog > div {
|     border: 1px solid #CCC;
|     border-right-color: #999;
|     border-left-color: #999;
|     border-bottom-color: #BBB;
|     border-top: #B00100 solid 4px;
|_    border-top-left-radius: 9p
Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel

Walkthrough :

1. Reconnaissance & Port Scanning

Start by performing a standard network scan using Nmap to discover open ports:

nmap -sC -sV -oN nmap_scan.txt <TARGET_IP>

Scan Results:

  • Port 22: SSH (Usually lacks a direct entry vector in the initial phase).
  • Port 3000: An HTTPS Web Application running an open-source software called Envizon.
  • Note: In some testing environments, port 4444 (Selenium) might be visible but is typically disabled in TryHackMe infrastructure due to high RAM usage.

Open your browser and navigate to https://<TARGET_IP>:3000. You will be greeted with the Envizon login page prompting for a password.

2. Authentication Bypass & IDOR (Foothold)

Since this room employs a white-box approach (source code is available), reviewing the functionality of the web routes reveals that the show function in the NotesController can be accessed without a valid login session (unauthenticated).

The application utilizes a Ruby gem named acts_as_hashids to obscure the original note IDs, preventing them from being easily guessed. However, an exception in the code allows notes with ID "1" to be called directly in its raw format via the /notes/1 path.

To read other sensitive notes (such as the note containing credentials at ID "380"), you need to calculate its corresponding hashid. According to the gem's documentation, if the application does not define a custom salt/secret, the model class name (Note) will be used as the default secret.

How to Calculate the Hashid via IRB (Ruby):

  1. Install the supporting package on your attacker machine
gem install hashids
  1. Run irb and execute the following script:
  2. ruby
require 'hashids' # Utilizing the 'Note' model name as the default salt hashids = Hashids.new("Note")  hashids.encode(380)
  • The calculation will output a unique hashid string.
  1. Access the URL https://<TARGET_IP>:3000/notes/<OBTAINED_HASH_ID> in your browser. You will find a valid Envizon web password to log into the main dashboard.

3. Command Injection & Reverse Shell Exploitation

Once successfully logged in, take advantage of Envizon's custom scan feature. This feature executes Nmap commands in the background. While standard termination characters are filtered, you can exploit Nmap's built-in --script parameter to execute system code (referencing the GTFOBins Nmap technique).

  1. Create a malicious file (.xml or .lua): Insert a command-executing Lua script (such as a reverse shell using ncat or /bin/sh).
  2. Upload the File: Use the XML scan file upload function provided by the application. This file will be stored in the /usr/src/app/envizon/nmap/uploads/ directory.
  3. Retrieve the Filename: Click on the Tasks menu at the bottom of the webpage or inspect the upload error logs to get the randomized filename generated by the system.
  4. Trigger the Command: Initiate a new scan and inject the following argument into the Nmap parameters:
--script /usr/src/app/envizon/nmap/uploads/<YOUR_FILENAME>.xml
  1. Set up a listener nc -lvnp <PORT> on your terminal. Once triggered, you will receive an initial reverse shell access with internal permissions inside the Docker container.

4. Privilege Escalation (Docker to Host Root)

While inspecting the file system inside the container, you will detect indications of an automated backup system named Borgmatic.

  1. Locate the default Borgmatic configuration file within the /etc/borgmatic/ directory or a similar location.
  2. Open the configuration file to find the backup repository password written in cleartext.
  3. Since the backup repository resides on the local file system, use Borgmatic commands to extract or inspect old backup archives:
borgmatic extract --archive <ARCHIVE_NAME>
  1. Within the extracted backup history data, you will find an unprotected SSH private key (id_rsa) belonging to the root user of the main host.
  2. Copy the private key to your machine, configure its permissions (chmod 600 id_rsa), and establish a direct connection to the main machine:
ssh -i id_rsa root@<TARGET_IP>

Task 1 Targeting a modern web application

You are facing an instance of the open source software "envizon" (https://github.com/evait-security/envizon) which is used by pentesters to visualize networks, find promising targets and a lot of other juicy stuff. It was developed by pentesters and should be almost unbreakable, right? The version 4.0.2alpha used here is still in permanent development and has not been tested for vulnerabilities yet. Your task is to find, exploit and chain vulnerabilities in a white-box approach in order to completely compromise the whole system.

You can find the source code for the current version here: https://gitlab.com/evait-security/envizon_thm

Three hints to start:

  • This is not an empty instance. Imagine that it is/was used and therefore contains user data
  • Currently a note function is under development
  • When looking for code execution on the system, the most obvious way is the best — it is important to understand what the application does

Selenium container and with it the screenshot function has been disabled because of the high ram usage.

Answer the questions below

Q1.) What password is used by the current envizon instance?

Hint : Vulnerability Types: Insecure direct object references (IDOR), Insecure/Predictable hash calculation

Answer : rE8ZqyM!DTKNP8fGu4T3CtWaurBQwLF

Q2.) local.txt

Hint : Vulnerability Types: Unrestricted file upload, Full path disclosure (optional), Command injection

Answer : 7953ba7f83b3fd00279627de052bc078

Q3.) root.txt

Hint : We always backup our stuff

cd /root
cat root.txt
40963d170c949f8325783c552e150236

Answer : 40963d170c949f8325783c552e150236

None None

I hope you enjoyed reading this post as much as I enjoyed writing it. Thanks for reading my blog sir ;) Lawvye