> For the complete documentation index, see [llms.txt](https://csbygb.gitbook.io/pentips/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://csbygb.gitbook.io/pentips/writeups/thmwriteups/thm-corridor.md).

# TryHackMe - Corridor

![Corridor](/files/079QZZaYVtIPStOKBCk9)

* [Room on THM](https://tryhackme.com/room/corridor)

When we acces the website, We land on this page.

![Landing page](/files/M0UP7grAu8xNkLY3vlsD)

Each door sends somewhere

![](/files/cIzzVeSSnQeCf7FUNdIU)

If we analyse the hashes they seem to be md5. Let's check one on [crackstation](https://crackstation.net/)

![first hash](/files/XAqMXItlQNr2pYWyvEyN)

Let's use intruder to increment the number and try to find the flag

![Intruder](/files/ewRYh1CaOOQ8hXrAP9yP)

These settings should do we need to process our payload and hash it in md5 like this

![md5 hash](/files/70BXRbDI6bmBxGey8N0w)

We got nothing this way.\
Then I realized I did not try 0.\
So I hashed zero in MD5 accessed the page and got the flag! :D