Extract — THM Writeup | The Hack Sparrow

Executive summary — Extract is a TryHackMe Hard room that isn't solved by a single bug but by chaining web vulnerabilities: an SSRF in /preview.php reaches internal services, the gopher protocol turns that SSRF into a proxy against a Next.js app bound only to localhost, a Next.js authentication bypass (CVE-2025-29927) hands over the first flag plus a set of credentials, and finally tampering with a poorly designed 2FA cookie unlocks the management panel and the second flag. A very realistic SSRF → Gopher → Auth bypass → 2FA bypass path.

Platform	TryHackMe
Operating system	Linux
Difficulty	Hard
Room	Extract
Target IP	`10.10.212.133`

Attack map

[80/HTTP]  TryBookMe — Online Library
   │  /preview.php?url=  →  SSRF (http:// and gopher:// OK, file:// blocked)
   ▼
[SSRF]  internal port scan (ffuf)  →  127.0.0.1:10000
   │  Next.js app reachable only from localhost
   ▼
[Next.js:10000]  gopher:// proxy + x-middleware-subrequest header
   │  CVE-2025-29927 (authentication bypass)  →  /customapi
   ▼
[Flag 1 + credentials]  librarian:L[REDACTED]!
   │  SSRF proxy to :80 /management/ (IP-restriction bypass)
   ▼
[2FA cookie]  AuthToken validated  b:0  →  b:1
   ▼
[Flag 2]  full compromise

1. Reconnaissance

We start by mapping the attack surface with an nmap scan (default scripts + version detection) across every port:

nmap -T4 -n -sC -sV -Pn -p- 10.10.212.133

Relevant ports:

Port	Service	Version
22/tcp	SSH	OpenSSH 9.6p1
80/tcp	HTTP	Apache 2.4.58

Analysis: with a well-patched SSH and a single web port exposed, the entry vector is almost certainly the web application. All initial enumeration focuses there.

Resumen ejecutivo — Extract es un room Hard de TryHackMe que no se resuelve con un solo fallo, sino encadenando vulnerabilidades web: una SSRF en /preview.php permite alcanzar servicios internos, el protocolo gopher convierte esa SSRF en un proxy hacia una aplicacion Next.js que escucha solo en localhost, un bypass de autenticacion de Next.js (CVE-2025-29927) entrega la primera flag y unas credenciales, y por ultimo la manipulacion de una cookie de 2FA mal diseñada abre el panel de gestion y la segunda flag. Un recorrido SSRF → Gopher → Auth bypass → 2FA bypass muy realista.

Plataforma	TryHackMe
Sistema operativo	Linux
Dificultad	Hard
Room	Extract
IP objetivo	`10.10.212.133`

Mapa del ataque

[80/HTTP]  TryBookMe — Online Library
   │  /preview.php?url=  →  SSRF (http:// y gopher:// OK, file:// bloqueado)
   ▼
[SSRF]  escaneo de puertos internos (ffuf)  →  127.0.0.1:10000
   │  aplicacion Next.js accesible solo desde localhost
   ▼
[Next.js:10000]  proxy gopher:// + cabecera x-middleware-subrequest
   │  CVE-2025-29927 (bypass de autenticacion)  →  /customapi
   ▼
[Flag 1 + credenciales]  librarian:L[REDACTED]!
   │  proxy SSRF hacia :80 /management/ (bypass de restriccion por IP)
   ▼
[Cookie 2FA]  AuthToken validated  b:0  →  b:1
   ▼
[Flag 2]  compromiso completo

1. Reconocimiento

Empezamos mapeando la superficie de ataque con un escaneo nmap con scripts por defecto y deteccion de versiones sobre todos los puertos:

nmap -T4 -n -sC -sV -Pn -p- 10.10.212.133

Puertos relevantes:

Puerto	Servicio	Version
22/tcp	SSH	OpenSSH 9.6p1
80/tcp	HTTP	Apache 2.4.58

Analisis: con SSH bien parcheado y un unico puerto web expuesto, el vector de entrada casi seguro es la aplicacion web. Toda la enumeracion inicial se concentra ahi.

🔒 Clearance required

This content is Root Access only. Everything else on the site — the free tier, the whole public library — stays open.

See Root Access plans

No account? Create one free then upgrade from your console.