> For the complete documentation index, see [llms.txt](https://0xb0b.gitbook.io/writeups/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://0xb0b.gitbook.io/writeups/tryhackme/2025/lo-fi.md).

# Lo-Fi

{% embed url="<https://tryhackme.com/r/room/lofi>" %}

The following post by 0xb0b is licensed under [CC BY 4.0<img src="https://mirrors.creativecommons.org/presskit/icons/cc.svg?ref=chooser-v1" alt="" data-size="line"><img src="https://mirrors.creativecommons.org/presskit/icons/by.svg?ref=chooser-v1" alt="" data-size="line">](http://creativecommons.org/licenses/by/4.0/?ref=chooser-v1)

***

In this challenge, we skip the Nmap scan. Since the room description already asks us to visit a web page, and we should test for local file inclusion here. On the Index page we have links to different genres.

<figure><img src="/files/Ua0EUaznVgPH7LGtDyol" alt=""><figcaption></figcaption></figure>

Clicking on one of the links, we get redirected by the page parameter. There is also a filter for at least absolute path.

```
http://lo-fi.thm/?page=
```

<figure><img src="/files/d8cal5P7QOSonJ28KGxY" alt=""><figcaption></figcaption></figure>

We test this parameter for LFIs with the `LFI-Jhaddix.txt` wordlist using FFuF. And we have some hits.

{% code overflow="wrap" %}

```
ffuf -w /usr/share/wordlists/SecLists/Fuzzing/LFI/LFI-Jhaddix.txt -u "http://lo-fi.thm/?page=FUZZ" -fl 124
```

{% endcode %}

<figure><img src="/files/5rm31dJczcr0HI7QjnIw" alt=""><figcaption></figcaption></figure>

We test the simplest one to include the `/etc/passwd` file. And we are successful.

```
http://lo-fi.thm/?page=../../../etc/passwd
```

<figure><img src="/files/YNNzMNuwGgAZpDBEDaUm" alt=""><figcaption></figcaption></figure>

Now we want to include the `/flag.txt` file, that we are asked for to get in the root directory of the system, and we have a hit.

```
http://lo-fi.thm/?page=../../../flag.txt
```

<figure><img src="/files/Sm94ggW5EsvDIkSVVFsg" alt=""><figcaption></figcaption></figure>