TryHackMe Anthem
Hello everyone, and welcome to this write-up!
Anthem is a beginner-friendly Windows Capture The Flag (CTF) machine designed to introduce fundamental penetration testing concepts. In this guide, I’ll demonstrate how I solved the Anthem room on TryHackMe by documenting each stage of the assessment, including reconnaissance, enumeration, credential discovery, initial access, and privilege escalation to obtain Administrator-level access. My goal is to provide a clear, step-by-step explanation of the techniques and methodology used throughout the assessment so that you can follow along and strengthen your penetration testing skills. I hope you enjoy the walkthrough!
You can access the TryHackMe Anthem room here:
🔗 https://tryhackme.com/room/anthem
Lesson Objectives
By completing the Anthem CTF, the following skills and techniques were practiced:
- Perform reconnaissance and information gathering using Nmap and Dirb.
- Identify a Content Management System (CMS) and enumerate its directories.
- Conduct Open-Source Intelligence (OSINT) to identify users, administrators, and infer corporate email addresses.
- Discover hidden information by inspecting HTML source code and metadata.
- Enumerate web application content to identify sensitive files and credentials.
- Gain initial access using discovered credentials to authenticate to the target system.
- Establish a Remote Desktop Protocol (RDP) session using xfreerdp.
- Perform local enumeration to identify hidden files and directories.
- Escalate privileges by modifying file permissions (ACLs) to access restricted files.
- Retrieve Administrator credentials and obtain the final root flag.
Task 1 Website Analysis
T1/Q1- Let’s run Nmap and check what ports are open.
No answer needednmap -sV -sC -Pn <target IP> --vv-sV(Version Detection): Confirms what software is running on open ports and tries to determine the exact version. This is critical for finding known vulnerabilities (like outdated software with public exploits).-sC(Default Scripts): Runs a collection of safe, default Nmap Scripting Engine (NSE) scripts. These scripts perform basic vulnerability checks, retrieve SSL certificate details, grab HTTP headers, and gather more context on the open ports.-Pn(No Ping): Tells Nmap to skip the initial host discovery (pinging the target) and treat the IP as active. This is extremely common in CTFs like Anthem, as many firewalls block ICMP ping requests, which might otherwise cause Nmap to falsely report the host as "down."--vv(Double Verbosity): Increases the verbosity level, showing you open ports the absolute millisecond they are discovered rather than making you wait until the entire scan is finished.
Using an Nmap scan, I identified that ports 80 (HTTP) and 3389 (RDP) are open on the target machine.
T1/ Q2- What port is for the web server?
The Nmap scan shows that port 80 (HTTP) is open, indicating that the target is hosting a web server accessible over the standard HTTP protocol.
Answer: 80
T1/ Q3-What port is for remote desktop service?
The Nmap scan identified port 3389 as open, indicating that Remote Desktop Protocol (RDP) is available on the target.
Remote Desktop Services (RDS) enable a computer to connect to, control, and interact with another computer over a network. The service detected as ms-wbt-server corresponds to Microsoft Terminal Services (RDP), which is officially registered as Windows-Based Terminal (WBT). This confirms that the target is accepting Remote Desktop connections, which may present an opportunity for further enumeration if valid credentials are obtained.
Answer: 3389
Web Enumeration
Information Gathering Using Dirb and Gobuster
During the web enumeration phase, we performed directory and file discovery using tools such as Dirb and Gobuster to identify publicly accessible resources and gather valuable information from the target web application.
The enumeration process helped us discover the following information:
- Website and domain name details
- Article and post names
- Content Management System (CMS) information
- Publication dates and timestamps
- Usernames and author information
- Email addresses
- Administrator details, including name and email information
- Potentially sensitive files and hidden flags
Dirb is a web content scanning tool used in penetration testing and security assessments to discover hidden directories and files on web servers. It performs brute-force directory and file enumeration by using predefined wordlists to identify potentially exposed resources, such as backup files, configuration files, administrative directories, or other sensitive information that may not be publicly accessible.
This information can be useful for further enumeration, identifying attack vectors, and understanding the structure of the web application.
dirb http://<target machine IP>
T1/ Q4- What is a possible password in one of the pages web crawlers check
for?
The Nmap scan output shows the following results:
The Dirb scan output shows the following results:
http://10.201.81.49/robots.txt
Answer: UmbracoIsTheBest!
T1 / Q5 — What CMS is the website using?
Content Management System (CMS) is a software application that enables users to create, manage, modify, and publish digital content through a structured interface. CMS platforms typically use databases to store and organize website content, allowing developers and administrators to efficiently maintain websites without requiring extensive programming knowledge.
The Dirb scan output shows the following results:
The Nmap scan output shows the following results:
http://10.201.81.49/umbraco
Answer: Umbraco
T1 / Q6- What is the domain of the website?
The Nmap scan results indicate that the target IP address is associated with anthem.com. This observation is further confirmed by accessing the target IP address through a web browser (Firefox), which redirects to or displays the anthem.com website. Together, these findings verify that the target IP belongs to the Anthem web infrastructure.
http://10.201.81.49
Answer: Anthem.com
The website’s publicly accessible blog revealed information about several authors that could be useful during the reconnaissance phase.
Finding 1 — Blog Author Information
- Post Title: We Are Hiring
- Author: Jane Doe
- Email Address: JD@anthem.com
- Observation: Jane Doe is identified as an author for the Anthem blog, and the disclosed email address could be used to identify the organization’s email naming convention.
Finding 2 — IT Personnel Information
- Post Title: A Cheers to Our IT Department
- Author: James Orchard Halliwell
- Potential Email Address: JH@anthem.com
- Observation: The blog post identifies James Orchard Halliwell as an IT administrator. The inferred email address follows the same naming convention and may represent a valid corporate email account.
T1 / Q7-What’s the name of the Administrator?
The blog post stated that the website administrator managed the entire website. Keywords from the article were collected and used for further OSINT research. By searching Google with the author’s name and the extracted keywords, the administrator’s name was successfully identified.
Born on a Monday,
Christened on Tuesday,
Married on Wednesday,
Took ill on Thursday,
Grew worse on Friday,
Died on Saturday,
Buried on Sunday.
That was the end…
By James Orchard Halliwell
Adminisrator Name: Solomon Grundy
Answer: Solomon Grundy
T1/ Q8- Can we find the email address of the administrator?
The /umbraco/ directory was identified through both the Nmap scan and Dirb directory enumeration. Accessing this directory revealed the Umbraco login page.
Based on the information gathered during reconnaissance, the following potential corporate email addresses were identified:
- Jane Doe: JD@anthem.com
- James Orchard Halliwell: JH@anthem.com (potential email address)
- Administrator Name: Solomon Grundy
- Inferred Email Address: SG@anthem.com (potential email address)
The inferred email address for the administrator was derived by following the same email naming convention observed for the other employees.
Further web enumeration of the robots.txt file exposed the password UmbracoIsTheBest!. Using the previously inferred email address SG@anthem.com together with the discovered password, successful authentication to the Umbraco administrative portal was achieved.
Answer: SG@anthem.com
Initial Access
Initial access was obtained by identifying the Umbraco administrative login page through directory enumeration. During web enumeration, valid credentials were discovered and used to authenticate successfully to the Umbraco administration portal.
After successful authentication, access to the administrative dashboard was confirmed. The Users section was then accessed to enumerate user accounts and continue the assessment.
USERNAME: SG@anthem.com (possible email address)
PASSWORD: UmbracoIsTheBest! (possible password address)
The email address and password were successfully verified and confirmed to be valid credentials.
Task 2 Spot the flags
Hidden Flag Discovery
T2 / Q1- What is flag 1?
During the review of the website pages, the page source code was inspected for hidden information. The “We Are Hiring” article was identified as containing a flag within the page’s meta content.
http://10.201.81.49/archive/we-are-hiring/
By selecting “Read this article” and viewing the page source code, the following flag was discovered:
Flag: THM{L0L_WH0_US3S_M3T4}
Get Zeliha Zengin’s stories in your inbox
Join Medium for free to get updates from this writer.
The flag was located inside the HTML metadata section of the page.
T2 / Q2- What is flag 2?
During the inspection of the website pages, the HTML source code and meta content were reviewed for hidden information. By accessing the articles through the “Read this article” option and analyzing the page source, a hidden flag was discovered within the metadata section.
http://10.201.81.49/archive/we-are-hiring/
http://10.201.81.49/archive/a-cheers-to-our-it-department/
The following flag was identified:
- Flag:
THM{G!T_G00D}
The flag was found within the metadata content of both the “We Are Hiring” and “A Cheers to Our IT Department” pages.
Answer: THM{G!T_G00D}
T2 / Q3- What is flag 3?
The Dirb scan output shows the following results:
http://10.201.81.49/authors
To enumerate the web directory structure, a directory brute-force scan was performed using Dirb. The scan identified the /authors directory, which provided access to additional author-related information.
Using the “Profile” hint, the discovered directory was investigated further. The same page could also be accessed by clicking on the author’s name, Jane Doe. The author’s profile page revealed the first flag, THM{L0L_WH0_D15}, which was embedded within the personal website link.
Answer: THM{L0L_WH0_D15}
T2 / Q4- What is flag 4?
During the review of the website pages, the page source code was inspected for hidden information. The “A Cheers to Our IT Department” article was identified as containing a hidden flag within its metadata content.
http://10.201.81.49/archive/a-cheers-to-our-it-department/
By selecting “Read this article” and viewing the page source code, the following flag was discovered:
Flag: THM{AN0TH3R_M3TA}
The flag was located within the HTML meta content of the “a-cheers-to-our-it-department” page.
Task 3 Final stage
T3 / Q1- Let’s figure out the username and password to log in to the box. (The box is not on a domain)
No answer neededT3 / Q2- Gain initial access to the machine, what is the contents of user.txt?
Remote Access Using Discovered Credentials
1. Option:
During the assessment, valid credentials were identified:
- Username: SG@anthem.com
- Password: UmbracoIsTheBest!
These credentials were used to establish a Remote Desktop Protocol (RDP) connection to the target system.
The remote session was initiated using the following command:
xfreerdp /u:SG /p:UmbracoIsTheBest! /v:[Target IP] /dynamic-resolutionAfter successfully accessing the system via RDP, recently modified files were reviewed. A file containing the Administrator account credentials was discovered, which could be used for further privilege escalation.
xfreerdp is used for connecting to Windows desktops, servers, or Remote
Desktop Services from Linux.
xfreerdp /u: :[Your Username] /p:[Your Password] /v:[Your IP]
/dynamic-resolution
xfreerdp /u:SG /p:UmbracoIsTheBest! /v:10.201.54.37 /dynamic-resolution
rdp: xfreerdp tool
• /u:SG: Username SG
• /p:UmbracoIsTheBest!: Password
• /v:10.201.54.37: Remote server IP
• /dynamic-resolution: Enables dynamic resolution updates (screen resizes
automatically when you resize the window)
Answer: THM{N00T_NO0T}
2. Option:
rdesktop is an open source UNIX client for connecting to Windows
Remote Desktop Services.
➤ rdesktop -u <user> p <Password> <Target IP>
➤ rdesktop -u SG -p UmbracoTheBest! 10.201.54.37
➤ User.txt is on the victim’s desktop. Click the user file to find the flag.
User Flag Discovery
After establishing an RDP connection to the target system, the user’s desktop was inspected for accessible files. A file named user.txt was identified on the victim’s desktop.
Opening the file revealed the user flag:
Flag: THM{N00T_NO0T}
Answer: THM{N00T_NO0T}
T3 / Q3- Can we spot the admin password?
The provided hint, “It is hidden.”, indicated that a hidden file or directory should be investigated. This prompted further enumeration of hidden files and folders on the target system.
Privilege Escalation — Accessing Restricted Backup Files
After gaining access to the victim’s desktop, further enumeration was performed to identify potential privilege escalation opportunities. A hint suggested investigating hidden files and directories.
Step 1: Enable Hidden Files and Folders
1.Options:
Following the provided hint, hidden files and folders were enabled in File Explorer to identify concealed resources on the target system.
The following steps were performed:
- Open File Explorer.
- Select the View tab.
- Enable the Hidden items option.
- Hidden files and folders became visible, revealing additional directories for further enumeration.
2.Options:
Hidden files were enabled through the following steps:
Control Panel → System and Security → Appearance and Personalization → File Explorer Options → View → Show hidden files, folders, and drives → Apply
Step 2: Locate the Restricted File
The following path was accessed:
C:\backupInside the directory, a file named restore.txt was discovered. However, the SG user account initially did not have permission to access the file.
Step 3: Modify File Permissions
The file permissions were updated to grant the SG account read access:
- Right-click restore.txt → Properties
- Navigate to the Security tab
- Select Edit → Add
- Add the user account:
WIN-LU09299160F\SG
Confirm the permissions changes and apply the settings.
After updating the ACL permissions, the restore.txt file was opened successfully, revealing the Administrator password.
Backup Directory: Navigate to the hidden backup folder. Inside, you will find a restore.txt file that contains the administrator's password.
This PC\Local Disk (C:)\C:\backup\restore.txt
The discovered Administrator credentials were then used for further access and privilege escalation.
Administator password: ChangeMeBaby1MoreTime
Answer: ChangeMeBaby1MoreTime
T3 / Q4- Escalate your privileges to root, what is the contents of root.txt?
Accessing the Administrator Password
After obtaining the necessary permissions, the following path was navigated:
This PC → Local Disk (C:) → Users → Administrator
This PC → Local Disk (C:) → Users → Administrator → Continue → Open "Administrator New Password" → Yes
When prompted, Continue was selected to access the Administrator profile. The Administrator New Password file was then opened, and the displayed credentials were retrieved for use during the privilege escalation process.
This PC → Local Disk (C:) → Users → Administrator → Desktop → root
The root.txt file was located on the Administrator’s desktop. Opening the file revealed the final root flag.
This assessment demonstrated the complete attack lifecycle, from reconnaissance and web enumeration to initial access and privilege escalation. Publicly available information, hidden web content, and exposed credentials were successfully leveraged to compromise the target system. After obtaining remote access, further local enumeration identified sensitive files containing Administrator credentials, which enabled privilege escalation and the retrieval of the final root flag. This exercise highlights the importance of securing publicly accessible information, protecting sensitive files and credentials, and implementing the principle of least privilege to reduce the risk of system compromise.
Thank you for taking the time to read my write-up! I hope this walkthrough was helpful and provided useful insights into the techniques and methodology used during the assessment.
You can find all of my write-ups here:
📚 Write-ups: https://medium.com/@zeliharich
Feel free to connect with me on LinkedIn:
🔗 LinkedIn: LinkedIn Profile
I appreciate your support and feedback. Keep learning, keep practicing, and happy hacking.
