> For the complete documentation index, see [llms.txt](https://0xb0b.gitbook.io/writeups/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://0xb0b.gitbook.io/writeups/tryhackme/2025/lo-fi.md).

# Lo-Fi

Want to hear some lo-fi beats, to relax or study to? We've got you covered! - by cmnatic

{% embed url="<https://tryhackme.com/r/room/lofi>" %}

The following post by 0xb0b is licensed under [CC BY 4.0<img src="https://mirrors.creativecommons.org/presskit/icons/cc.svg?ref=chooser-v1" alt="" data-size="line"><img src="https://mirrors.creativecommons.org/presskit/icons/by.svg?ref=chooser-v1" alt="" data-size="line">](http://creativecommons.org/licenses/by/4.0/?ref=chooser-v1)

***

In this challenge, we skip the Nmap scan. Since the room description already asks us to visit a web page, and we should test for local file inclusion here. On the Index page we have links to different genres.

<figure><img src="https://2148487935-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FoqaFccsCrwKo1CHmLRKW%2Fuploads%2FyrRT8Nu7kiCYJRVGgBQy%2Fgrafik.png?alt=media&amp;token=a5f23bd0-bcfa-418a-80c9-c2075442d521" alt=""><figcaption></figcaption></figure>

Clicking on one of the links, we get redirected by the page parameter. There is also a filter for at least absolute path.

```
http://lo-fi.thm/?page=
```

<figure><img src="https://2148487935-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FoqaFccsCrwKo1CHmLRKW%2Fuploads%2FQuMHUloyU9frtT62yhDR%2Fgrafik.png?alt=media&amp;token=c4f8319c-ec0d-4a31-84bf-e162714fdf2e" alt=""><figcaption></figcaption></figure>

We test this parameter for LFIs with the `LFI-Jhaddix.txt` wordlist using FFuF. And we have some hits.

{% code overflow="wrap" %}

```
ffuf -w /usr/share/wordlists/SecLists/Fuzzing/LFI/LFI-Jhaddix.txt -u "http://lo-fi.thm/?page=FUZZ" -fl 124
```

{% endcode %}

<figure><img src="https://2148487935-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FoqaFccsCrwKo1CHmLRKW%2Fuploads%2FlrOfdpDhlpinRkCF2RrL%2Fgrafik.png?alt=media&amp;token=34f89fce-8bd7-4eff-83a1-74f69d9be0b7" alt=""><figcaption></figcaption></figure>

We test the simplest one to include the `/etc/passwd` file. And we are successful.

```
http://lo-fi.thm/?page=../../../etc/passwd
```

<figure><img src="https://2148487935-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FoqaFccsCrwKo1CHmLRKW%2Fuploads%2F4u4fWsY9pG7Zet5pe2EM%2Fgrafik.png?alt=media&amp;token=b37fdc40-6b72-40eb-abcd-95c1c233f2d4" alt=""><figcaption></figcaption></figure>

Now we want to include the `/flag.txt` file, that we are asked for to get in the root directory of the system, and we have a hit.

```
http://lo-fi.thm/?page=../../../flag.txt
```

<figure><img src="https://2148487935-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FoqaFccsCrwKo1CHmLRKW%2Fuploads%2FTwFB8jmyu46EQMGwClDW%2Fgrafik.png?alt=media&amp;token=78b76793-a5e4-49f4-b18d-f3b86692cdbe" alt=""><figcaption></figcaption></figure>