hoS / blog
Post
writeup 2024-01-25 · 3 min read

TryHackMe Biohazard Writeup (Resident Evil Room)

Every flag in the mansion, from the dining room emblem to the four encoded crests that hide the FTP login, then umbrella_guest over SSH and root as weasker.

Guilherme Alves
TryHackMe Linux Web FTP SSH
TryHackMe Biohazard Writeup (Resident Evil Room)

Summary

Biohazard is a Resident Evil themed room where the mansion is a web server and every room is a directory. The dining room’s page source hides a base64 pointer to the tea room, which yields the lockpick, and the chain continues through the bar room’s music sheet and gold emblem, the second floor dining room’s Vigenere clue to the blue jewel, and the tiger statue room. Four notes scattered across the gallery, armor, attic and first crest areas each carry a crest encoded two or three times over base64, base32, base58, binary and hex; decoding them and concatenating the four gives the FTP credentials hunter:you_cant_hide_forever. Part two moves to the guard house, where three keys are carved out of images with forensics tooling and combine into the plant42 passphrase, the study room’s doom.tar.gz gives the SSH user umbrella_guest, and the hidden closet’s MO disk and wolf medal give the SSH password. In the underground laboratory, the jail cell holds MO disk 2 and the key to become weasker, who may run anything with sudo, so sudo su finishes the room.

  • export IP=10.10.253.33

22/tcp on 10.10.253.33 OpenSSH 7.6p1 Ubuntu 4ubuntu0.3 80/tcp on 10.10.253.33 Apache httpd 2.4.29 21/tcp on 10.10.253.33 vsftpd 3.0.3

/mansionmain Chris, Jill, Barry, Weasker and Joseph

/diningRoom view-source:http[:]//10.10.253.33/diningRoom/

  • HTML Comment

[ Base64 decoded: How about the /teaRoom/ ] - emblem{fec832623ea498e20bf4fe1821d58727} [ Emblem ] http[:]//10.10.253.33/diningRoom/emblem.php

  • Via the gold emblem key there is a shield key inside the dining room. The html page is called the_great_shield_key
  • shield_key{48a7a9227cd7eb89f0a062590798cbac} http[:]//10.10.253.33/diningRoom/the_great_shield_key.html

/teaRoom

  • lock_pick{037b35e2ff90916a9abf99129c8e1837} [ Lockpick ] http[:]//10.10.253.33/teaRoom/master_of_unlock.html

/artRoom/

  • Mansion map [ http[:]//10.10.253.33/artRoom/MansionMap.html ] Location: [x] /diningRoom/ [x] /teaRoom/ [x] /artRoom/ [x] /barRoom/ [x] /diningRoom2F/ [x] /tigerStatusRoom/ [x] /galleryRoom/ [x] /studyRoom/ [x] /armorRoom/ [x] /attic/

/barRoom/

  • Unlocked using the lockpick
  • music_sheet{362d72deaf65f5bdc63daece6a1f676e} [ Music ]
  • http[:]//10.10.253.33/barRoom357162e3db904857963e6e0b64b96ba7/musicNote.html [ Base32 decoded w/ cyberchef ]
  • gold_emblem{58a8c41a9d08b8a4e38d02a4d7ff4843} [ Via music sheet flag ] http[:]//10.10.253.33/barRoom357162e3db904857963e6e0b64b96ba7/gold_emblem.php

rebecca [ Used emblem flag // ?? ] http[:]//10.10.253.33/barRoom357162e3db904857963e6e0b64b96ba7/barRoomHidden.php

Mansion flag area

1
2
3
4
5
6
7
8

emblem{fec832623ea498e20bf4fe1821d58727}
lock_pick{037b35e2ff90916a9abf99129c8e1837}
music_sheet{362d72deaf65f5bdc63daece6a1f676e}
gold_emblem{58a8c41a9d08b8a4e38d02a4d7ff4843}
shield_key{48a7a9227cd7eb89f0a062590798cbac}
blue_jewel{e1d457e96cac640f863ec7bc475d48aa}

helmet_key{458493193501d2b94bbab2e727f8db4b}

/diningRoom2F/

  • HTML Comment

[ Viginere cipher ] - You get the blue gem by pushing the status to the lower floor. The gem is on the diningRoom first floor. Visit sapphire.html

  • blue_jewel{e1d457e96cac640f863ec7bc475d48aa} http[:]//10.10.253.33/diningRoom/sapphire.html

/tigerStatusRoom/

  • Using the gem key… http[:]//10.10.253.33/tigerStatusRoom/gem.php

Crest 1 final: RlRQIHVzZXI6IG [ Base64 & base32 decoded ]

S0pXRkVVS0pKQkxIVVdTWUpFM0VTUlk9 Hint 1: Crest 1 has been encoded twice Hint 2: Crest 1 contanis 14 letters

Note: You need to collect all 4 crests, combine and decode to reavel another path The combination should be crest 1 + crest 2 + crest 3 + crest 4. Also, the combination is a type of encoded base and you need to decode it

/galleryRoom/

  • Used the shield key…
  • note.txt http[:]//10.10.253.33/galleryRoom/note.txt

Crest 2 final: h1bnRlciwgRlRQIHBh [ Base32 & Base 58 decoded ]

GVFWK5KHK5WTGTCILE4DKY3DNN4GQQRTM5AVCTKE Hint 1: Crest 2 has been encoded twice Hint 2: Crest 2 contanis 18 letters

/armorRoom/ http[:]//10.10.253.33/armorRoom547845982c18936a25a9b37096b21fc1/note.txt

Crest 3 final: c3M6IHlvdV9jYW50X2h [ Base64, Binary & Hexadecimal ]

MDAxMTAxMTAgMDAxMTAwMTEgMDAxMDAwMDAgMDAxMTAwMTEgMDAxMTAwMTEgMDAxMDAwMDAgMDAxMTAxMDAgMDExMDAxMDAgMDAxMDAwMDAgMDAxMTAwMTEgMDAxMTAxMTAgMDAxMDAwMDAgMDAxMTAxMDAgMDAxMTEwMDEgMDAxMDAwMDAgMDAxMTAxMDAgMDAxMTEwMDAgMDAxMDAwMDAgMDAxMTAxMTAgMDExMDAwMTEgMDAxMDAwMDAgMDAxMTAxMTEgMDAxMTAxMTAgMDAxMDAwMDAgMDAxMTAxMTAgMDAxMTAxMDAgMDAxMDAwMDAgMDAxMTAxMDEgMDAxMTAxMTAgMDAxMDAwMDAgMDAxMTAwMTEgMDAxMTEwMDEgMDAxMDAwMDAgMDAxMTAxMTAgMDExMDAwMDEgMDAxMDAwMDAgMDAxMTAxMDEgMDAxMTEwMDEgMDAxMDAwMDAgMDAxMTAxMDEgMDAxMTAxMTEgMDAxMDAwMDAgMDAxMTAwMTEgMDAxMTAxMDEgMDAxMDAwMDAgMDAxMTAwMTEgMDAxMTAwMDAgMDAxMDAwMDAgMDAxMTAxMDEgMDAxMTEwMDAgMDAxMDAwMDAgMDAxMTAwMTEgMDAxMTAwMTAgMDAxMDAwMDAgMDAxMTAxMTAgMDAxMTEwMDA= Hint 1: Crest 3 has been encoded three times Hint 2: Crest 3 contanis 19 letters

/attic/

  • Used the shield key…
  • note.txt http[:]//10.10.253.33/attic909447f184afdfb352af8b8a25ffff1d/note.txt

Crest 4 final: pZGVfZm9yZXZlcg== [ Base58 & hexadecimal decoded ]

gSUERauVpvKzRpyPpuYz66JDmRTbJubaoArM6CAQsnVwte6zF9J4GGYyun3k5qM9ma4s Hint 1: Crest 2 has been encoded twice Hint 2: Crest 2 contanis 17 characters

Final crest area

1
2
3

RlRQIHVzZXI6IGh1bnRlciwgRlRQIHBhc3M6IHlvdV9jYW50X2hpZGVfZm9yZXZlcg==

FTP user: hunter, FTP pass: you_cant_hide_forever   [ From base64 ]

Part 02 – Guard house

  • Using forenscis techniques, able to retrive all 3 keys from the images
  • Key1 + key2 + key3 value: cGxhbnQ0Ml9jYW5fYmVfZGVzdHJveV93aXRoX3Zqb2x0

plant42_can_be_destroy_with_vjolt [ Base64 decoded ]

helmet key helmet_key{458493193501d2b94bbab2e727f8db4b}

/studyRoom doom.tar.gz $ tar -xvf doom.tar.gz

  • eagle_medal.txt SSH user: umbrella_guest

/hidden_closet/

  • Disk 1 http[:]//10.10.253.33/hiddenCloset8997e740cb7f5cece994381b9477ec38/MO_DISK1.txt weasker login password, stars_members_are_my_guinea_pig [ From viginere ]

  • wolf medal http[:]//10.10.253.33/hiddenCloset8997e740cb7f5cece994381b9477ec38/wolf_medal.txt SSH password: T_virus_rules

Part 03 - Underground laboratory

/home/umbrella_guest/.jailcell

  • MO disk 2: “key to decipher something” [ MO disk 2: albert ] su weasker sudo -l User weasker may run the following commands on umbrella_corp: (ALL : ALL) ALL $ sudo su
  • Owned!

3c5794a00dc56c35f2bf096571edf3bf [ Root flag ]

Writeups TryHackMe
TryHackMe Linux Web FTP SSH Steganography Cryptography Base64 Vigenere Cipher Information Disclosure Sudo Privilege Escalation
This post is licensed under CC BY 4.0 by the author.