TryHackMe: Anthem CTF Walkthrough

In cybersecurity, successful exploitation is rarely about luck — it is built on thorough, methodical reconnaissance. This write-up covers the Anthem CTF challenge from TryHackMe, a beginner-level room focusing on exploiting a Windows machine. The goal of this walkthrough is to demonstrate a structured approach to web reconnaissance, web enumeration, initial access via RDP, and privilege escalation through permission modification. By following this methodology, we will locate hidden flags, extract credentials, and escalate our privileges to Administrator.

Step 1: Reconnaissance & EnumerationQ1-Q3: Port Scanning with Nmap

We begin by scanning the target host using Nmap to identify open ports and service versions:

nmap -sV -sC -Pn <target IP>

nmap -sV -sC -Pn <target IP>

• Port 80/tcp (HTTP): Microsoft HTTPAPI httpd 2.0 (SSDP/UPnP)
• Port 3389/tcp (Microsoft Terminal Services / RDP): Remote Desktop Service used for interacting with the machine over a network

Step 2: Web Enumeration & Information GatheringQ4-Q6: Directory Bruteforcing & Web Analysis

Using directory enumeration tools like Dirb, we uncover hidden directories and files on the web server:

dirb http://<target IP>

dirb http://<target IP>

• Robots.txt Analysis: Checking http://<target IP>/robots.txt reveals search engine crawling rules and a potential password: UmbracoIsTheBest!

• CMS Identification: The website runs on Umbraco CMS, an open-source content management system built on Microsoft's .NET technology.

Domain Name: Anthem.com

Q7-Q8: Finding Administrator Credentials

• Reviewing blog posts and poem references (such as Solomon Grundy written by James Orchard Halliwell) helps us identify the administrator name as Solomon Grundy.

Following the naming convention (SG@anthem.com), we combine this email with the password found in robots.txt (UmbracoIsTheBest!) to log into the Umbraco admin panel at /umbraco.

• Found JD@anthem.com
• SG@anthem.com should be the admin email

email: SG@anthem.com password: UmbracoIsTheBest!

Step 3: Finding Hidden Flags (Web App)

Flag 1 (THM{LOL_WHO_US3S_M3T4}): Found inside the meta description of the "We are hiring" page source code.

Flag 2 (THM{G!T_GOOD}): Found inside the source code/search placeholder of the "A cheers to our IT department" page.

• Flag 3 (THM{LOL_WHO_D15}): Found on Jane Doe's author profile page (/authors).

• Flag 4 (THM{ANOTH3R_M3TA}): Found in the meta content of the "A cheers to our IT department" page source code.

Step 4: Initial Access via RDP & User Flag

Using the discovered credentials (SG@anthem.com / UmbracoIsTheBest!), we connect to the Windows machine via RDP using xfreerdp or rdesktop:

xfreerdp /u:SG /p:UmbracoIsTheBest! /v:<target IP> /dynamic-resolution

xfreerdp /u:SG /p:UmbracoIsTheBest! /v:<target IP> /dynamic-resolution

Once inside the victim's desktop, we open the user text file to capture the user flag:

• Answer: THM{NOOT_NOOT}

Step 5: Privilege Escalation & Root FlagEscalating Privileges to Administrator

Show Hidden Files: Open File Explorer, go to the View tab, and check Hidden items to reveal hidden files and folders on the C: drive.

Access Backup Folder: Navigate to C:\backup, where a file named restore.txt is located. Initially, user SG lacks permissions to read it.

Modify File Permissions (ACL): Right-click restore.txt > Properties > Security > Edit > Add > type SG, click Check Names, and grant Read permissions.

Retrieve Admin Password: Open restore.txt to read the administrator's new password: ChangeMeBaby1MoreTime.

Capture Root Flag: Use the administrator credentials to access the Administrator's desktop (C:\Users\Administrator\Desktop\root), open root.txt, and capture the final flag:

Answer: THM{YOU_4R3_1337}