The Bandit Surfer (THM) Tryhackme Hard Challenge

Difficulty : Hard

Note : All of the content and images are from https://tryhackme.com/

Room : https://tryhackme.com/room/surfingyetiiscomingtotown

Enjoy.

Task 1 Breaking Into the Best Festival Company

The Story

Ha! I've outdone meself, me hearty! After pokin' through every digital nook and cranny, crackin' a router wide open, and sneakin' into Frost-eau's laptop, I've unearthed every last secret, leadin' me straight to the heart of the icy storm. This is it, the moment I've been waitin' for since last year's icy fiasco — my shot at redemption in the frozen wilderness. But that sly detective Frost-eau is hot on my snowy trail. I gotta be quick as a hare and sly as a fox to stay ahead.

Now, over on the other side of the Pole, I hear Frost-eau's been yappin' with McSkidy — that crafty female CISO who nabbed me last time. They're cookin' up something new, something big, and it's already rollin' out. Frost-eau's all ears, tryin' to dig up more dirt, but the info's as scarce as sunlight in winter.

He's got a hunch, though, that I, the Bandit Yeti, is plannin' to stir up a blizzard with this merger mess. And he's right to worry — that server they're all fussin' over ain't been put through its paces yet. If someone, say a certain Yeti, were to sneak into that server, it wouldn't just be the Best Festival Company's secrets at their fingertips — AntarctiCrafts would be an open book, too!

But while Frost-eau's twiddlin' his thumbs waitin' for clues, I am already leapin' into action. I've sniffed out the server and begun weavin' my web, usin' it as my secret passage back into the Best Festival Company's lair. "Can you do it?" I hear you ask. Well of course, I can! I'm the Bandit Yeti, the legend of the digital tundra! Savvy? Now, heave ho! Let's show 'em what happens when they cross paths with the king of the cold!

Important Note

This room is part of the Advent of Cyber 2023 Side Quest Challenge.

Please visit the Side Quest room to input the final flag of this room!

Answer the questions below

Q1.) What is the user flag?

THM{SQli_SsRF_2_WeRkZeuG_PiN_ExPloit}

THM{SQli_SsRF_2_WeRkZeuG_PiN_ExPloit}

Answer : THM{SQli_SsRF_2_WeRkZeuG_PiN_ExPloit}

Q2.) What is the root flag?

root@proddb:~# cat root.txt
THM{BaNDiT_YeTi_Lik3s_PATH_HijacKing}

root@proddb:~# cat root.txt
THM{BaNDiT_YeTi_Lik3s_PATH_HijacKing}

Answer : THM{BaNDiT_YeTi_Lik3s_PATH_HijacKing}

Q3.) What is the yetikey4.txt flag?

root@proddb:~# yetikey4.txt
4-3f$FEBwD6AoqnyLjJ!!Hk4tc*V6w$UuK#evLWkBp

root@proddb:~# yetikey4.txt
4-3f$FEBwD6AoqnyLjJ!!Hk4tc*V6w$UuK#evLWkBp

Answer : 4–3f$FEBwD6AoqnyLjJ!!Hk4tc*V6w$UuK#evLWkBp

I hope you enjoyed reading this post as much as I enjoyed writing it. Thanks for reading my blog sir ;) Lawvye