# ColddBox: Easy Room on TryHackMe: Complete Walkthrough and Guide

---

**LINK -** [https://tryhackme.com/room/colddboxeasy](https://tryhackme.com/room/colddboxeasy)

---

## OVERVIEW

![](https://cdn.hashnode.com/res/hashnode/image/upload/v1767456906632/adc832bd-431a-463a-b893-6dfb7eab6699.png align="center")

We are given an IP Address Let’s scan it using NMAP

## ENUMERATION

![](https://cdn.hashnode.com/res/hashnode/image/upload/v1767457350733/b053c8bd-ea0a-489f-bc7e-b4f3b24824c6.png align="center")

So we have two open ports PORT 80 and PORT 4512 of web and ssh respectively  
Also we can see the website is running WordPress 4.1.31 so we can use **wpscan** on it

Let’s see the website first

![](https://cdn.hashnode.com/res/hashnode/image/upload/v1767457536314/e8eba42b-c2f3-4723-b671-9ed84d3313d6.png align="center")

There is a login page of WordPress let’s try default username and passwords

![](https://cdn.hashnode.com/res/hashnode/image/upload/v1767457973518/301f323d-de99-4f9d-b0e4-8feb9462c5f6.png align="left")

But it failed….

So Let’s enumerate directories using **gobuster**

```apache
gobuster dir -u http://10.66.155.139/ -w /usr/share/wordlists/dirb/common.txt -x php,txt
```

![](https://cdn.hashnode.com/res/hashnode/image/upload/v1767458459166/a046c282-db12-4578-9b2f-535edae465ba.png align="center")

So there we have one **/hidden** directory let’s check it out

![](https://cdn.hashnode.com/res/hashnode/image/upload/v1767458136977/38bfe191-bc58-43a9-a3b1-e908bdafac1a.png align="center")

And we found three usernames which we can use to bruteforce the WordPress Login but first let’s run **wpscan** on the website maybe will find some vulnerable plugin or themes.

```apache
wpscan -v -e --url http://10.66.155.139/wp-login.php
```

![](https://cdn.hashnode.com/res/hashnode/image/upload/v1767458978943/d07fb965-8ccb-4780-8770-07a7a5b00875.png align="center")

And we found nothing useful so let’s bruteforce the passwords with our users using **wpscan**

```apache
wpscan -U users.txt -P /usr/share/wordlists/rockyou.txt --url http://10.66.155.139/
```

![](https://cdn.hashnode.com/res/hashnode/image/upload/v1767459873956/6dd24cc5-c980-4f29-aec1-44316fbdd45d.png align="center")

And we found the user c0ldd password now let’s login into the WordPress admin page with the given credentials

![](https://cdn.hashnode.com/res/hashnode/image/upload/v1767460008830/71624755-6064-4646-bed0-598c157595f5.png align="center")

We are inside the WordPress site now let’s checkout editor tab in Appearance to see if we can edit some code to get reverse shell

![](https://cdn.hashnode.com/res/hashnode/image/upload/v1767460246454/4e4c372e-3703-416d-8870-0960ab4e476f.png align="center")

**There is 404 Template in the templates section which has 404.php which we can use to get reverse shell**

So get the PHP PentestMonkey reverse shell script from [revshells.com](https://www.revshells.com/) and paste it in here  
Now open a netcat listener in your terminal

```apache
nc -lvnp PORT
```

Now click on Update and you will update the 404.php code

![](https://cdn.hashnode.com/res/hashnode/image/upload/v1767460560483/04940e55-9129-4007-9978-55287baa674b.png align="center")

Now navigate to 404.php from the URL so that it can get executed and can give us reverse shell

```apache
http://10.66.155.139/wp-content/themes/twentyfifteen/404.php
```

Go to this site and you will automatically will get the reverse shell

![](https://cdn.hashnode.com/res/hashnode/image/upload/v1767460704689/7ec3080f-21dc-44b9-9c96-5baa29112527.png align="center")

**Since we can’t read user.txt as we are not the user c0ldd But**  
Now we can read the **wp-config.php** from the **/var/www/html** directory which we saw in gobuster as it usually has some creds

![](https://cdn.hashnode.com/res/hashnode/image/upload/v1767460864622/b28e0e84-2674-4ac2-85ca-715addf951f6.png align="center")

Seems We were right there is MYSQL DB credential of the user c0ldd  
I enumerated the MySQL but didn’t found anything useful rather then the hash of the passwords of the three users we found earlier as their passwords will only work in WordPress website so there is no point in cracking those.

---

## USER FLAG

Then I remembered that this password can be reused somewhere and our PORT 4512 of ssh came into my mind so let’s try using these creds to login as c0ldd

```apache
ssh c0ldd@10.66.155.139 -p 4512
```

![](https://cdn.hashnode.com/res/hashnode/image/upload/v1767461159451/61a5c2db-7cf0-406b-9fad-230148026761.png align="center")

Here we go we were right and now you can grab user.txt from **/home/c0ldd directory**

---

## PRIVILEGE ESCALATION / ROOT FLAG

Now let’s try to escalate privileges and like every time we will start from `sudo -l` command

![](https://cdn.hashnode.com/res/hashnode/image/upload/v1767461388096/b86fa113-6dcf-426f-a077-02f5344d06fc.png align="center")

And we found it three services that can help me escalating privileges you can either use vim or ftp to escalate privileges but i will here use ftp so

```apache
sudo ftp
!/bin/bash
```

![](https://cdn.hashnode.com/res/hashnode/image/upload/v1767461487068/8f891399-a936-46ab-875a-effea443e31d.png align="left")

And Like this you got the root flag too.

## **WE FINALLY DID IT !!!! CHALLENGE SOLVED !!**

![](https://cdn.hashnode.com/res/hashnode/image/upload/v1767461607694/d9a74f5a-21f6-4abd-b1c6-ffe5c6bf394e.png align="center")

For Any Query Or Problem Either Leave A Comment Or Contact At [**reapsec.com**](http://reapsec.com/)

**THANKS FOR READING !!!**