Post cover image

September 13, 2026

Checkmate Challenge — TryHackMe Walkthrough

Challenge Link: https://tryhackme.com/room/checkmate

By S4F4L

5 min read

Source : TryHackMe

Challenge Description

Marco Bianchi, a systems administrator, recently deployed several internal services, including a firewall console, employee portal, social platform, and SSH access to critical infrastructure. Due to tight deadlines and operational pressure, Marco reused weak, predictable, and pattern-based passwords across multiple systems.

Your objective is to conduct a password security assessment to identify weaknesses in Marco's authentication practices.

None

Start by accessing the main application at http://10.114.162.38:5000. From there, you will be guided through each stage of the challenge, uncovering and exploiting weaknesses in Marco's password usage.

First step: nmap scan of the machine.

nmap -sV -sS -p- -T4 10.114.162.38
None

So the services are available in port 22, 5000, 5001, 5002, 5003.

  1. What is the password for Level 1?

To find the password for the level 1, we follow the description, let's navigate to http://10.114.162.38:5000/ (Note: Consider the IP in your own case). We can see the webpage as:

None

The webpage is saying in level 1 that Marco deployed a firewall at firewall.thm:5001 but kept the default credentials. So, let's find out the default password.

Add this in your hosts file.

None

After adding you can access the firewall webpage from http://firewall.thm:5001

None

I have created a list of potential default passwords available from different sources.

None

After creating a list, I use the ffuf for the brute force attack to find the Level 1.

ffuf -w /root/default_pass.txt -X POST -d "username=admin&password=FUZZ" -H "Content-Type: application/x-www-form-urlencoded" -u http://firewall.thm:5001/login -fc 200
None None

We got our answer: 12345

None

Login successful!

2. What is the password for Level 2?

Navigating to jobs.thm. For this: Add the domain in the host file as above.

None

I saw this button is only interactive while other's are disabled for the lab purpose. The employee portal login page pop up when I pressed the button.

None

Since, marco has used company keywords as passwords, let's crawl the site and grab the company's keyword with the help of cewl.

cewl -d 2 -m 3 --lowercase --with-numbers -e --email_file job_emails.txt -w company_words.txt http://jobs.thm:5002

We get two text file:

None

Let's use the file that we extract from the website and perform the brute force attack to find the Level 2 password.

ffuf -w /home/kali/Desktop/Checkmate/company_words.txt  -X POST -d "username=marco&password=FUZZ" -H "Content-Type: application/x-www-form-urlencoded" -u http://jobs.thm:5002/login -fc 200
None

We got our answer, the Level 2 password is excellence.

3. What is the password for Level 3?

For level 3 password, it is asking us to derive Marco's password from personal information.

None

Details of Marco Bianchi

None

So, we have to create our own wordlist password. We can use crunch for that. There is also a tool call CUPP (Common User Passwords Profiler).

First with clutch:

crunch 11 11 -t Marco%%%%%% > marco_password.txt
crunch 11 11 -t Bianchi%%%% >> marco_password.txt
crunch 11 11 -t marky%%%%%% >> marco_password.txt
None

With CUPP: Can be installed with sudo apt install cupp

cupp -i
None None 
ffuf -w /home/kali/Desktop/Checkmate/marco_password.txt  -X POST -d "username=marco&password=FUZZ" -H "Content-Type: application/x-www-form-urlencoded" -u http://social.thm:5003/login -fc 200
fuf -w /home/kali/Desktop/Checkmate/marco.txt  -X POST -d "username=marco&password=FUZZ" -H "Content-Type: application/x-www-form-urlencoded" -u http://social.thm:5003/login -fc 200
None

We get the level three password Bianchi2495

4. What is the password for Level 4?

Description for level 4 is

None

So, the platform automatically renames the uploaded files to SHA256 hash of the original filename. Let's find out the filename which is in (SHA256Hash).png

None

The hash value is:

d34a569ab7aaa54dacd715ae64953455d86b768846cd0085ef4e9e7471489b7b

Cracking the hash with john

john --format=raw-sha256 --wordlist=/usr/share/wordlists/rockyou.txt hash.txt
None

Alternatively, with crackstation.

None

So, level 4 password is family

5. What is the password for Level 5?

Description for level 5 .

None None

So marco's password pattern is : Company keyword, capitalize it, then append the year like 2024 or any other number and and exclamation mark.

nano ssh_pass.txt

security
excellence
innovation
digital
cloud

Making the marco's pattern.


awk '{
    word=toupper(substr($0,1,1)) tolower(substr($0,2))
    for (year=2020; year<=2026; year++)
        print word year "!"
}' ssh_pass.txt > marco_ssh_password.txt
None

Hydra ssh brute force.

hydra -l marco -P marco_ssh_password.txt ssh://10.114.158.92 -t 4 -f -V
None

Level 5 password is Security2024!

Takeaway

From this challenge we have learned that the default password if not changed is very sensitive, anyone can acces with default entry. Along with that we have also seen that the company friendly passsword is also not very strong and recommended, it can be easily get enumerated from tools like cewl. Guessable password from our name, surname, pet and partner names are also not that strong and if someone get that information, the wordlist can be easily created and can be used in brute force. We also demonstrate the use of weak hash algorithm, how easily they can be cracked. At last, the pattern of the password should be very unique and must not follow the predictable mark.