One thing that frustrates me a bit when it comes to HTB academy is that it practically forces you to buy the yearly, that way you can actually "learn" how to do the class. Therefore, I figured might as well do some write-ups for anyone who needs help.

Firstly, make sure to spawn the target in, in my case,

Something to note about hackthebox attacks that isn't mentioned within the academy, is that the port number is where the malicious *thing* is, it's a neat little hint for things like this.

In the previous lessons, it taught us about nmap, however, the first command that should be ran is

_Side Note, if you want to know the "proper" way to sccan for the ports, just do `nmap -sV -sC -p- [Target IP]` might take a bit though.

This will do an "aggressive" scan, which basically does all of the following without requiring us to actually put in the command:

- OS Detection (-O): Attempts to identify the operating system running on the target.

- Version Detection (-sV): Probes open ports to determine what specific service and version number are running (e.g., Apache 2.4.41 instead of just "http").

- Script Scanning (-sC): Runs a collection of default Nmap Scripting Engine (NSE) scripts to check for common vulnerabilities or gather more information about services.

- Traceroute (--traceroute): Maps the network path from your machine to the target host.

Additionally, the -p causes the specific port to be scanned.

Here we can see it's "Just Another Wordpress Site". Therefore, if we try to go to the domain:

Now it's time to use metasploit and see what we can do

Next, we need to search for an exploit. rather than trying to be extremely complex and such, let's just look for wordpress and the plugin that's quite literally... on the screen.

From there we will see an output in regards to the exploits, there will only be one.

Then, like in previous tutorials, we need to see what kind of information we must put in to use the exploit, therefore:

Here we see that we need to set RHOST, RPORT, and FILEPATH. therefore

afterwards, simply type `exploit`.

then you can type `exit` upon execution, and find the file that you requested within your file manager. in my case it was just in the home directory and contained the flag.