Anthem - THM

This is the writeup for the TryHackMe easy difficulty room called Anthem .

This is going to be an exploitable website.
Since we shouldn’t show any flags or answers for the tasks, we will only show you the method how you can get the answers.

1st Part - Recon

CMD: nmap -sT -sV -F $IP -Pn
 
Starting Nmap 7.94SVN ( https://nmap.org ) at 2025-10-28 16:10 CET
Nmap scan report for 10.10.93.22
Host is up (0.082s latency).
Not shown: 98 filtered tcp ports (no-response)
PORT     STATE SERVICE       VERSION
[[REDACTED]]/tcp   open  http          Microsoft HTTPAPI httpd 2.0 (SSDP/UPnP)
[[REDACTED]]/tcp open  ms-wbt-server Microsoft Terminal Services
Service Info: OS: Windows; CPE: cpe:/o:microsoft:windows
 
Service detection performed. Please report any incorrect results at https://nmap.org/submit/.
Nmap done: 1 IP address (1 host up) scanned in 13.66 seconds

The nmap scan show us what port the webserver and the RDP server are running on.
These two port numbers are the answers for the 2nd and 3rd tasks.

The 4th task mentions something about web crawlers.
We know that the crawlers always check the robots.txt file if it exists.

The first line of the file reveals the password.

The browser addon Wappalyzer tells us what CMS the website is using.

Hmmm what might be the domain of the website, I wonder…

The 7th task is to find the name of the admin.

Looking up the lines of the poem we find a name.

For the 8th task we have to find out the email of the admin.

This article shows the email of Jane Doe which is JD@anthem.com. If we follow this logic the administrator’s email will be the admin’s initials followed by @anthem.com.

2nd Part - Flag Hunt

The 1st and 2nd flag are found in the source code of the page located at http://$IP/archive/we-are-hiring/

The 3rd flag is on the page http://$IP/authors/jane-doe/

The 4th flag is found in the source code of the page located at http://$IP/archive/a-cheers-to-our-it-department/

3rd Part - RDP Access

The task says that we already have the credentials to authenticate to the machine via RDP.

The username is the initials of the admin user written all caps. The password is the one we already found in the robots.txt file.

After accessing the desktop the first flag is found in the file called user.txt.

If we look closely we discover a hidden folder called backup in the root folder of the system drive.

The hidden folder contains a file called restore.txt but we don’t have permissions to read it.

However we are able to modify its permissions and add our account with full access to it.

To get the admin flag we just have to login via RDP using the username: Administrator and the previous password.