# THM WriteUP | Corridor

# **Intro**

Hello ethical hackers! Today we are going to pass the [**Coriddor**](https://tryhackme.com/room/corridor) on [**TryHackMe**](https://tryhackme.com/). This lab has tags: IDOR, Web.

# Recon

## Scanning

For no need to enter IP again and again. I exported IP like a variable in current bash shell.

```javascript
export IP=*.*.*.*
```

Then i scan the host with [**rustscan**](https://github.com/RustScan/RustScan).

![](https://cdn.hashnode.com/res/hashnode/image/upload/v1676466889651/f6de60f9-a438-4a8c-9d0d-4986bf79eb2a.png align="center")

Find only web. Ok.

## Web

![](https://cdn.hashnode.com/res/hashnode/image/upload/v1676467196533/a9f339bd-aec8-4ad5-9ce4-6a85f5487fea.png align="center")

Check source code:

![](https://cdn.hashnode.com/res/hashnode/image/upload/v1676467169556/4e59cbd0-92cb-4df4-b46f-6d4589ff6d9a.png align="center")

We find a lot of links to strange location. But... may be it's hash?

# Hash

![](https://cdn.hashnode.com/res/hashnode/image/upload/v1676467273615/2eeae001-a04f-4879-b314-ea992d03b637.png align="center")

Yeah, it's MD5

I will use [crackstation](https://crackstation.net/) for decrypt MD5.

![](https://cdn.hashnode.com/res/hashnode/image/upload/v1676467464417/607cf3c1-7326-408d-91f8-7305cc68aebc.png align="center")

Okey, we decrypt all hashes. It's number from 1 to 13. Ussualy array start from 0. We will also try to start from 0.

[Encode 0 with MD5](https://gchq.github.io/CyberChef/#recipe=MD5()&input=MA)

![](https://cdn.hashnode.com/res/hashnode/image/upload/v1676467662484/4d80bd91-439b-4890-9ed2-d8f8bf6385c8.png align="center")

# Exploit IDOR

Insert new md5 hash to IP and found the right door!

![](https://cdn.hashnode.com/res/hashnode/image/upload/v1676467780482/5097a05b-7ccc-4147-be65-1e5c4de9d05f.png align="center")