October 18, 2026
Anthem Walkthrough | TryHackMe
Hey everyone! I hope you’re doing well. Let’s do this beginner friendly Windows privilege escalation challenge.
By Himender Sharma
3 min read
We'll start by scanning the box using nmap.
Whoops! Well, let's try again with -Pn flag to skip ping probes and assume our machine is up which it is.
Voila! Now, let's answer each question.
Website Analysis
Q. What port is for the web server?
80
Q. What port is for remote desktop service?
3389
Q. What is a possible password in one of the pages web crawlers check for?
Visit http://10.49.129.137/robots.txt
UmbracoIsTheBest!
Q. What CMS is the website using?
Umbraco
Q. What is the domain of the website?
Anthem.com
Q. What's the name of the Administrator?
This here is a modified version of the nursery rhyme called Solomon Grundy.
Q. Can we find find the email address of the administrator?
Yes, just like the email of Jane Doe is JD@anthem.com. The email of the administrator is SG@anthem.com
Spot the flags
curl http://10.49.129.137/archive/we-are-hiring/ | grep "THM"
curl http://10.49.129.137/authors/jane-doe/ | grep "THM"
curl http://10.49.129.137/archive/a-cheers-to-our-it-department/ | grep "THM"curl http://10.49.129.137/archive/we-are-hiring/ | grep "THM"
curl http://10.49.129.137/authors/jane-doe/ | grep "THM"
curl http://10.49.129.137/archive/a-cheers-to-our-it-department/ | grep "THM"Run the above commands to find all the flags in one go!
Q. What is flag 1?
view-source:http://10.49.129.137/archive/we-are-hiring/
Find the flag at line 13. Refer to the image below if that didnt help.
Q. What is flag 2?
view-source:http://10.49.129.137/
Find the flag at line 51. Refer to the image below if that didnt help.
Q. What is flag 3?
visit http://10.49.129.137/authors/jane-doe/ to find the flag in all its glory.
Q. What is flag 4?
view-source:http://10.49.129.137/
Find the flag at line 13. Refer to the image below if that didnt help.
Final Stage
Q. Let's figure out the username and password to log in to the box.(The box is not on a domain)
SG:UmbracoIsTheBest!
Let's use xfreerdp to connect to the machine.
xfreerdp /v:10.49.129.137 /u:SG /p:UmbracoIsTheBest!xfreerdp /v:10.49.129.137 /u:SG /p:UmbracoIsTheBest!Q. Gain initial access to the machine, what is the contents of user.txt?
Just open the file in notepad. Its on the Desktop.
Q. Can we spot the admin password?
Barely! But, once you check the Hidden items box — you'll find a backup folder.
And there it is !
But not so fast — this file can only be accessed by an administrator. Luckily, we can modify the permissions and grant ourselves access.
So, the admin password is ChangeMeBaby1MoreTime.
Now, xfreerdp into Administrator account.
xfreerdp /v:10.49.129.137 /u:Administrator /p:ChangeMeBaby1MoreTimexfreerdp /v:10.49.129.137 /u:Administrator /p:ChangeMeBaby1MoreTimeQ. Escalate your privileges to root, what is the contents of root.txt?
Go get it ! Victory is yours!
Thank you for reading! I hope you found this helpful. Until next time!