DigDug Writeup

472 words

2 minutes

DigDug Writeup

2026-03-22

TryHackMe

Writeup

/

Easy

/

TryHackMe

So today I am going to try another tryhackme room called Dig Dug. This is about DNS servers. I have already completed the DNS room before so this shouldnt be a problem right?#

Let’s get started.#

Room Link#

Dig Dug

Let’s get digging. I know a tool called dig which is used to query DNS servers. So I will use that because the room name is dig dug lol.#

1
┌──(igris㉿kali)-[~/Desktop]
2
└─$ dig 10.201.125.40
3

4
; <<>> DiG 9.20.11-4+b1-Debian <<>> 10.201.125.40
5
;; global options: +cmd
6
;; Got answer:
7
;; ->>HEADER<<- opcode: QUERY, status: NXDOMAIN, id: 23965
8
;; flags: qr rd ra ad; QUERY: 1, ANSWER: 0, AUTHORITY: 1, ADDITIONAL: 1
9

10
;; OPT PSEUDOSECTION:
11
; EDNS: version: 0, flags:; udp: 512
12
;; QUESTION SECTION:
13
;10.201.125.40.                 IN      A
14

15
;; AUTHORITY SECTION:
16
.                       86397   IN      SOA     a.root-servers.net. nstld.verisign-grs.com. 2025101301 1800 900 604800 86400
17

18
;; Query time: 72 msec
19
;; SERVER: 8.8.8.8#53(8.8.8.8) (UDP)
20
;; WHEN: Mon Oct 13 22:52:21 EDT 2025
21
;; MSG SIZE  rcvd: 117

Well that wasnt so useful. I also did a nmap scan just in case.#

1
┌──(igris㉿kali)-[~/Desktop]
2
└─$ nmap -sV 10.201.125.40
3
Starting Nmap 7.95 ( https://nmap.org ) at 2025-10-13 22:39 EDT
4
Nmap scan report for 10.201.125.40 (10.201.125.40)
5
Host is up (0.27s latency).
6
Not shown: 999 closed tcp ports (reset)
7
PORT   STATE SERVICE VERSION
8
22/tcp open  ssh     OpenSSH 8.2p1 Ubuntu 4ubuntu0.13 (Ubuntu Linux; protocol 2.0)
9
Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel
10

11
Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
12
Nmap done: 1 IP address (1 host up) scanned in 3.40 seconds

Wow port 53 didnt show up. I knew that port 53 was for DNS services so why isnt it open????#

I searched online for a while and found out that we can add custom domains in the dig search.#

In the room description there was a hint#

1
Oooh, turns out, this 10.201.125.40 machine is also a DNS server!
2
If we could dig into it, I am sure we could find some interesting records!
3
But... it seems weird, this only responds to a special type of request for a givemetheflag.com domain?

Here there was a mention of givemetheflag.com so I tried to use that in dig.#

1
┌──(igris㉿kali)-[~/Desktop]
2
└─$ dig -h
3
Usage:  dig [@global-server] [domain] [q-type] [q-class] {q-opt}
4
            {global-d-opt} host [@local-server] {local-d-opt}
5
            [ host [@local-server] {local-d-opt} [...]]

I got a way to insert the domain in the serach with the command dig givemetheflag.com @{server}. And i used it.#

1
┌──(igris㉿kali)-[~/Desktop]
2
└─$ dig givemetheflag.com @10.201.125.40
3

4
; <<>> DiG 9.20.11-4+b1-Debian <<>> givemetheflag.com @10.201.125.40
5
;; global options: +cmd
6
;; Got answer:
7
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 61061
8
;; flags: qr aa; QUERY: 1, ANSWER: 1, AUTHORITY: 0, ADDITIONAL: 0
9

10
;; QUESTION SECTION:
11
;givemetheflag.com.             IN      A
12

13
;; ANSWER SECTION:
14
givemetheflag.com.      0       IN      TXT     "flag{REDACTED}"
15

16
;; Query time: 272 msec
17
;; SERVER: 10.201.125.40#53(10.201.125.40) (UDP)
18
;; WHEN: Mon Oct 13 23:00:27 EDT 2025
19
;; MSG SIZE  rcvd: 86