This Grep challenge tests your reconnaissance and OSINT skills using a vulnerable machine hosted on TryHackMe.
Start this room by hitting the “deploy” button. Once deployed, you are assigned an IP address.
Below is the Nmap command used for scanning:
Nmap Command:
sudo nmap -n -A -Pn --min-parallelism 100 -T5 -p- <IP>The scan reveals three open ports.
Visit port 80 and you’ll see the default Apache page. Directory busting yields no useful results.
On port 443, a certificate error is displayed.
Inspect the certificate and find a clue: the domain grep.thm.
Add an entry to /etc/hosts mapping the IP to grep.thm.
Ping the domain to confirm it’s properly configured.
Now browse to https://grep.thm.
Attempt to register an account.
An error appears: “Invalid or expired API key.”
Search GitHub for “SearchME grep.thm”.
In the repo, locate register.php and find the removed API key.
The API key is:
ffe60ecaa8bba2f12b43d1a4b15b8f39
Intercept the registration request in Burp Suite, replace the API key with the correct one, and forward it.
Registration is successful.
Log in to your account and retrieve the first flag.
Flag 1: THM{4e****************************bb}
Check the GitHub repo again and locate upload.php. It validates files using hex signatures (JPG, PNG, GIF).
Visit the upload.php page.
Use Pentestmonkey’s PHP Reverse Shell and edit it with your IP and port.
Rename the file with .jpg extension and adjust its hex signature to match a real image.
Edit magic bytes using a hex editor.
Change the hex values as required.
Upload the file.
Successful upload confirmation appears.
Access the uploaded file to get a reverse shell.
TIPIf you don’t receive a reverse shell, move the
<?phptag in the script after a comment line at the starting. This avoids corruption from hex editing the first line.
With shell access, locate users.sql containing admin credentials.
Admin Email: admin@searchme2023cms.grep.thm
Navigate to the leakchecker directory and find two files. One checks for leaked credentials.
Leak checker hostname: leakchecker.grep.thm
Add this subdomain to /etc/hosts.
Go to https://leakchecker.grep.thm, enter the admin email, and the password is revealed.
Admin Password: a**************!