Lo-Fi

Recon

nmap

nmap finds two open ports: SHH (22) and HTTP (80).

22/tcp open  ssh     syn-ack ttl 63 OpenSSH 8.2p1 Ubuntu 4ubuntu0.4 (Ubuntu Linux; protocol 2.0)
| ssh-hostkey: 
|   3072 a5:bb:bf:c5:ad:2e:71:fb:7a:36:ea:e2:b2:41:3a:7d (RSA)
|   256 da:9e:d3:4d:ca:9e:e7:38:52:bd:e7:1e:1e:05:f2:8e (ECDSA)
|   256 9e:58:b0:2b:4c:bd:d3:47:cd:f0:40:9d:96:8d:75:49 (ED25519)
80/tcp open  http    syn-ack ttl 62 Apache httpd 2.2.22 ((Ubuntu))
|_http-title: Lo-Fi Music
| http-methods: 
|_  Supported Methods: GET HEAD POST OPTIONS
|_http-server-header: Apache/2.2.22 (Ubuntu)

HTTP - TCP 80

The website features links to various Lo-Fi beats to enjoy. Music tracks are included using a page parameter: http://10.x.x.x/?page=relax.php.

Reading the Flag

The page parameter is vulnerable to Local File Inclusion (LFI): http://10.x.x.x/?page=../../../etc/passwd. As indicated in the room description, the flag is located in the root of the filesystem. Using the LFI vulnerability, the flag can be read with: http://10.x.x.x/?page=../../../flag.txt.