Writeup

THM: Smol

A walkthrough of the TryHackMe Smol machine covering WordPress exploitation, vulnerable plugin abuse, backdoored plugin analysis, and privilege escalation.

TryHackMe WordPress Plugin Exploitation Privilege Escalation

Overview

At the heart of Smol is a WordPress website, a common target due to its extensive plugin ecosystem. The machine showcases a publicly known vulnerable plugin, highlighting the risks of neglecting software updates and security patches. Enhancing the learning experience, Smol introduces a backdoored plugin, emphasizing the significance of meticulous code inspection before integrating third-party components.

Walkthrough

Step 1 —

Step 2 —

Step 3 —

Step 4 —

Step 5 —

Step 6 —

Step 7 —

Step 8 —

Summary

Tools Used

  • Nmap — port scanning and service detection.
  • WPScan — WordPress enumeration.
  • Searchsploit — exploit database lookup.
  • cURL / Burp Suite — HTTP request crafting.
  • Netcat — reverse shell listener.
  • LinPEAS / manual enumeration — privilege escalation.

Lessons Learned

Back to Red Teaming