Traverse

Room Link: https://tryhackme.com/room/traverse

Allow pasting by entering 'allow pasting' into the console than paste your code for the flag

The admin page allows us to run two commands, so I fired up burp and can see I can change the command.

We can see in the above screenshot the password for the original file manager

Username: admin
Password: THM{10101}

On the index page theres a if statement that checks the message is equal to' FINALLY HACKED' if it is set then it goes to the hacked page so I just changed the value of message.