---
title: "Corridor - TryHackMe"
slug: "corridor"
collection: "writeups"
status: "published"
publishedAt: "2026-10-19T16:30:33.872Z"
updatedAt: "2026-10-20T03:10:02.703Z"
canonical: "https://0.0.0.0:3000/writeups/corridor"
platform: "TryHackMe"
challengeName: "Corridor"
machineName: "Corridor"
difficulty: "easy"
category: "web"
---

# Corridor - TryHackMe

> Can you escape the Corridor?

![Screenshot 2026-10-19 16:36:30 (image)](https://0.0.0.0:3000/api/media/file/media/33002f0e-image.png)

> You have found yourself in a strange corridor. Can you find your way back to where you came? In this challenge, you will explore potential IDOR vulnerabilities. Examine the URL endpoints you access as you navigate the website and note the hexadecimal values you find (they look an awful lot like a *hash*, don't they?). This could help you uncover website locations you were not expected to access.

lakukan scanning ip yang diberikan 

```bash
$ nmap -sC -sV -oA nmap/initial 10.49.137.200 --reason
Starting Nmap 7.99 ( https://nmap.org ) at 2026-10-20 00:57 +0700
Nmap scan report for 10.49.137.200
Host is up, received timestamp-reply ttl 62 (0.093s latency).
Not shown: 999 closed tcp ports (reset)
PORT   STATE SERVICE REASON         VERSION
80/tcp open  http    syn-ack ttl 61 Werkzeug httpd 2.0.3 (Python 3.10.2)
|_http-title: Corridor

Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 14.28 seconds

```

hanya port 80 yang aktif, jadi langsung aja di akses

![Screenshot 2026-10-19 17:59:55 (image)](https://0.0.0.0:3000/api/media/file/media/d38ea8b0-image.png)

hmm hanya ada web dengan tampilan literally coridor dengan banyak pintu dan tiap pintu bisa di buka masing2

```bash
<map name="image-map">
        <area target="" alt="c4ca4238a0b923820dcc509a6f75849b" title="c4ca4238a0b923820dcc509a6f75849b" href="c4ca4238a0b923820dcc509a6f75849b" coords="257,893,258,332,325,351,325,860" shape="poly">
        <area target="" alt="c81e728d9d4c2f636f067f89cc14862c" title="c81e728d9d4c2f636f067f89cc14862c" href="c81e728d9d4c2f636f067f89cc14862c" coords="469,766,503,747,501,405,474,394" shape="poly">
        <area target="" alt="eccbc87e4b5ce2fe28308fd9f2a7baf3" title="eccbc87e4b5ce2fe28308fd9f2a7baf3" href="eccbc87e4b5ce2fe28308fd9f2a7baf3" coords="585,698,598,691,593,429,584,421" shape="poly">
        <area target="" alt="a87ff679a2f3e71d9181a67b7542122c" title="a87ff679a2f3e71d9181a67b7542122c" href="a87ff679a2f3e71d9181a67b7542122c" coords="650,658,644,437,658,652,655,437" shape="poly">
        <area target="" alt="e4da3b7fbbce2345d7772b0674a318d5" title="e4da3b7fbbce2345d7772b0674a318d5" href="e4da3b7fbbce2345d7772b0674a318d5" coords="692,637,690,455,695,628,695,467" shape="poly">
        <area target="" alt="1679091c5a880faf6fb5e6087eb1b2dc" title="1679091c5a880faf6fb5e6087eb1b2dc" href="1679091c5a880faf6fb5e6087eb1b2dc" coords="719,620,719,458,728,471,728,609" shape="poly">
        <area target="" alt="8f14e45fceea167a5a36dedd4bea2543" title="8f14e45fceea167a5a36dedd4bea2543" href="8f14e45fceea167a5a36dedd4bea2543" coords="857,612,933,610,936,456,852,455" shape="poly">
        <area target="" alt="c9f0f895fb98ab9159f51fd0297e236d" title="c9f0f895fb98ab9159f51fd0297e236d" href="c9f0f895fb98ab9159f51fd0297e236d" coords="1475,857,1473,354,1537,335,1541,901" shape="poly">
        <area target="" alt="45c48cce2e2d7fbdea1afc51c7c6ad26" title="45c48cce2e2d7fbdea1afc51c7c6ad26" href="45c48cce2e2d7fbdea1afc51c7c6ad26" coords="1324,766,1300,752,1303,401,1325,397" shape="poly">
        <area target="" alt="d3d9446802a44259755d38e6d163e820" title="d3d9446802a44259755d38e6d163e820" href="d3d9446802a44259755d38e6d163e820" coords="1202,695,1217,704,1222,423,1203,423" shape="poly">
        <area target="" alt="6512bd43d9caa6e02c990b0a82652dca" title="6512bd43d9caa6e02c990b0a82652dca" href="6512bd43d9caa6e02c990b0a82652dca" coords="1154,668,1146,661,1144,442,1157,442" shape="poly">
        <area target="" alt="c20ad4d76fe97759aa27a0c99bff6710" title="c20ad4d76fe97759aa27a0c99bff6710" href="c20ad4d76fe97759aa27a0c99bff6710" coords="1105,628,1116,633,1113,447,1102,447" shape="poly">
        <area target="" alt="c51ce410c124a10e0db5e4b97fc2af39" title="c51ce410c124a10e0db5e4b97fc2af39" href="c51ce410c124a10e0db5e4b97fc2af39" coords="1073,609,1081,620,1082,459,1073,463" shape="poly">
    </map>

```

jika di lihat source code nya semua pintu yang bisa di buka itu link ke sebuah hash, nah untuk melihat semua hash nya bisa menggunakan crackstation

![Screenshot 2026-10-20 03:01:43 (image)](https://0.0.0.0:3000/api/media/file/media/b4c20d6c-image.png)

ternyata semua hash tersebut adalah angka urut dari 1 sampai 13, dan untuk kerentanan IDOR [https://portswigger.net/web-security/access-control/idor](https://portswigger.net/web-security/access-control/idor)

biasanya yang dicari adalah id 0 maknanya adalah user yang diciptakan pertama atau admin biasanya, jadi coba lihat hash MD5 dari 0 lalu jadikan itu endpoint

![Screenshot 2026-10-20 03:07:05 (image)](https://0.0.0.0:3000/api/media/file/media/cb399dae-image.png)


dan well berhasil dapat flag nya

![Screenshot 2026-10-20 03:04:45 (image)](https://0.0.0.0:3000/api/media/file/media/e41cc529-image.png)

# flag{2477ef02448ad9156661ac40a6b8862e}