> For the complete documentation index, see [llms.txt](https://repo.4pfsec.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://repo.4pfsec.com/tryhackme/advent-of-cyber-3-2021/day-3-christmas-blackout.md).

# \[Day 3] Christmas Blackout

## Challenge

Accessing the site reveals a login form as shown below.

![](/files/8wJX9ghsZVK1Q02A5cFQ)

Since there was no attack vector via the main page, I scanned the web directory for hidden directories with the command below.

```
gobuster dir -u http://10.10.11.109/ -e -w /usr/share/wordlists/dirb/common.txt -t 100 -x .php,.txt,.html,.cnf,.conf | tee gobuster.log
```

While running that, I noticed a URL `10.10.11.109/admin` with a redirect status code.

![](/files/QheB6tXbSPp9mxZCXWXc)

{% hint style="success" %}
Using a common wordlist for discovering content, enumerate <http://10.10.11.109> to find the location of the administrator dashboard. What is the name of the folder?

* admin
  {% endhint %}

`10.10.11.109/admin/` returned the following.

![](/files/1CEZCQJaXgEo1m8wj10e)

Trying `administrator:administrator` logged me into the admin portal and revealed the flag!

{% hint style="success" %}
In your web browser, try some default credentials on the newly discovered login form for the "administrator" user. What is the password?

* administrator
  {% endhint %}

![](/files/14Yuso8xfFPGPPum6LCb)

{% hint style="success" %}
Access the admin panel. What is the value of the flag?

* THM{ADM1N\_\*\*\*\*\*}
  {% endhint %}