Post cover image

July 25, 2026

WordPress Penetration Testing and Privilege Escalation

Leveraging RustScan, OpenVas, BurpSuite and NMAP for Rapid Network Enumeration

By CyberLabyrinthX

7 min read

Looz: 1 Looz: 1, made by mhz_cyber & Zamba. Download & walkthrough links are available.

None None

In the initial reconnaissance phase, I executed a high-speed port scan against the target machine using RustScan (sudo rustscan -a 192.168.0.108) to bypass the typical speed bottlenecks associated with standard sequential scanning. Once RustScan rapidly identified the open ports, it automatically handed them off to Nmap to run a targeted SYN stealth scan and confirm the underlying service versions. The scan revealed a total of four open ports on the target machine with the MAC address 08:00:27:CD:BD:62. The discovered services include SSH on port 22 , an HTTP web server on port 80, a MySQL database on port 3306, and a service running on port 8081 identified as blackice-icecap.

None

Although the initial RustScan results focused primarily on the active ports it caught quickly, the follow-up Nmap aggressive scan (-sS -A -F -sC) provided a much wider scope by explicitly evaluating additional ports like 139 and 445, revealing that they were closed. Furthermore, Nmap unlocked precise version details such as OpenSSH 8.2p1, Nginx 1.18.0, MariaDB 5.5.5-10.5.10, and Apache httpd 2.4.38, which were not detailed in the RustScan port scan phase.

None None

Based on the reconnaissance results from RustScan, Nmap, and OpenVAS, I have gathered enough findings to move forward.

None

Here, I initiated directory brute forcing attack using Gobuster with the SecLists wordlist and common file extensions to look for hidden directories or administrative panels. However, the enumeration only returned standard assets such as index.html and the images directory and yielded no immediate high-value targets or hidden files.

While analyzing the HTTP traffic using Burp Suite Proxy, I inspected the response headers returned by the target server (192.168.0.108:8081). The headers revealed critical technology version disclosure, exposing the underlying system components.

None

After confirming the website is the WordPress, I attempted to access port 8081 and navigate to the /wp-login page but I was redirected to this page.

None None

Then I started enumerating themes on this WordPress website.

None 
         __          _______   _____
         \ \        / /  __ \ / ____|
          \ \  /\  / /| |__) | (___   ___  __ _ _ __ ®
           \ \/  \/ / |  ___/ \___ \ / __|/ _` | '_ \
            \  /\  /  | |     ____) | (__| (_| | | | |
             \/  \/   |_|    |_____/ \___|\__,_|_| |_|

                  WordPress Security Scanner
                         Version 4.0.1
                    An Automattic endeavor
                    https://automattic.com
_______________________________________________________________

[+] URL: http://wp.looz.com/ [192.168.0.108]
[+] Started: Sat Jul 25 05:21:56 2026
[+] Command Line: wpscan --url http://wp.looz.com/ --enumerate t --api-token [REDACTED]
[+] Hostname: cipherfrost

Interesting Finding(s):

[+] Headers
 | Interesting Entries:
 |  - Server: nginx/1.18.0 (Ubuntu)
 |  - X-Powered-By: PHP/7.4.20
 | Found By: Headers (Passive Detection)
 | Confidence: 100%

[+] XML-RPC seems to be enabled: http://wp.looz.com/xmlrpc.php
 | Found By: Direct Access (Aggressive Detection)
 | Confidence: 100%
 | References:
 |  - http://codex.wordpress.org/XML-RPC_Pingback_API
 |  - https://www.rapid7.com/db/modules/auxiliary/scanner/http/wordpress_ghost_scanner/
 |  - https://www.rapid7.com/db/modules/auxiliary/dos/http/wordpress_xmlrpc_dos/
 |  - https://www.rapid7.com/db/modules/auxiliary/scanner/http/wordpress_xmlrpc_login/
 |  - https://www.rapid7.com/db/modules/auxiliary/scanner/http/wordpress_pingback_access/

[+] WordPress readme found: http://wp.looz.com/readme.html
 | Found By: Direct Access (Aggressive Detection)
 | Confidence: 100%

[+] The external WP-Cron seems to be enabled: http://wp.looz.com/wp-cron.php
 | Found By: Direct Access (Aggressive Detection)
 | Confidence: 60%
 | References:
 |  - https://www.iplocation.net/defend-wordpress-from-ddos
 |  - https://github.com/wpscanteam/wpscan/issues/1299

[+] WordPress version 5.7.2 identified (Insecure, released on 2021-05-12).
 | Found By: Rss Generator (Passive Detection)
 |  - http://wp.looz.com/?feed=rss2, <generator>https://wordpress.org/?v=5.7.2</generator>
 | Confirmed By: Rss Generator (Passive Detection)
 |  - http://wp.looz.com/?feed=comments-rss2, <generator>https://wordpress.org/?v=5.7.2</generator>

[+] WordPress theme in use: twentytwentyone
 | Location: http://wp.looz.com/wp-content/themes/twentytwentyone/
 | Last Updated: 2026-05-19 7:00pm GMT (2 months ago, per WordPress.org)
 | Active Installs: 200,000 (per WordPress.org)
 | Readme: http://wp.looz.com/wp-content/themes/twentytwentyone/readme.txt
 | [!] The version is out of date, the latest version is 2.8
 | Style URL: http://wp.looz.com/wp-content/themes/twentytwentyone/style.css?ver=1.3
 | Style Name: Twenty Twenty-One
 | Style URI: https://wordpress.org/themes/twentytwentyone/
 | Description: Twenty Twenty-One is a blank canvas for your ideas and it makes the block editor your best brush. Wi...
 | Author: the WordPress team
 | Author URI: https://wordpress.org/
 |
 | Found By: Css Style In Homepage (Passive Detection)
 |
 | Version: 1.3 (80% confidence)
 | Found By: Style (Passive Detection)
 |  - http://wp.looz.com/wp-content/themes/twentytwentyone/style.css?ver=1.3, Match: 'Version: 1.3'

[+] Enumerating Most Popular Themes (via Passive and Aggressive Methods)

[+] twentytwentyone
 | Location: http://wp.looz.com/wp-content/themes/twentytwentyone/
 | Last Updated: 2026-05-19 7:00pm GMT (2 months ago, per WordPress.org)
 | Active Installs: 200,000 (per WordPress.org)
 | Readme: http://wp.looz.com/wp-content/themes/twentytwentyone/readme.txt
 | [!] The version is out of date, the latest version is 2.8
 | Style URL: http://wp.looz.com/wp-content/themes/twentytwentyone/style.css
 | Style Name: Twenty Twenty-One
 | Style URI: https://wordpress.org/themes/twentytwentyone/
 | Description: Twenty Twenty-One is a blank canvas for your ideas and it makes the block editor your best brush. Wi...
 | Author: the WordPress team
 | Author URI: https://wordpress.org/
 |
 | Found By: Urls In Homepage (Passive Detection)
 |
 | Version: 1.3 (80% confidence)
 | Found By: Style (Passive Detection)
 |  - http://wp.looz.com/wp-content/themes/twentytwentyone/style.css, Match: 'Version: 1.3'

[+] twentynineteen
 | Location: http://wp.looz.com/wp-content/themes/twentynineteen/
 | Last Updated: 2026-05-19 7:00pm GMT (2 months ago, per WordPress.org)
 | Active Installs: 90,000 (per WordPress.org)
 | Readme: http://wp.looz.com/wp-content/themes/twentynineteen/readme.txt
 | [!] The version is out of date, the latest version is 3.3
 | Style URL: http://wp.looz.com/wp-content/themes/twentynineteen/style.css
 | Style Name: Twenty Nineteen
 | Style URI: https://wordpress.org/themes/twentynineteen/
 | Description: Our 2019 default theme is designed to show off the power of the block editor. It features custom sty...
 | Author: the WordPress team
 | Author URI: https://wordpress.org/
 |
 | Found By: Known Locations (Aggressive Detection)
 |  - http://wp.looz.com/wp-content/themes/twentynineteen/, status: 500
 |
 | Version: 2.0 (80% confidence)
 | Found By: Style (Passive Detection)
 |  - http://wp.looz.com/wp-content/themes/twentynineteen/style.css, Match: 'Version: 2.0'

[+] twentytwenty
 | Location: http://wp.looz.com/wp-content/themes/twentytwenty/
 | Last Updated: 2026-05-19 7:00pm GMT (2 months ago, per WordPress.org)
 | Active Installs: 200,000 (per WordPress.org)
 | Readme: http://wp.looz.com/wp-content/themes/twentytwenty/readme.txt
 | [!] The version is out of date, the latest version is 3.1
 | Style URL: http://wp.looz.com/wp-content/themes/twentytwenty/style.css
 | Style Name: Twenty Twenty
 | Style URI: https://wordpress.org/themes/twentytwenty/
 | Description: Our default theme for 2020 is designed to take full advantage of the flexibility of the block editor...
 | Author: the WordPress team
 | Author URI: https://wordpress.org/
 |
 | Found By: Known Locations (Aggressive Detection)
 |  - http://wp.looz.com/wp-content/themes/twentytwenty/, status: 500
 |
 | Version: 1.7 (80% confidence)
 | Found By: Style (Passive Detection)
 |  - http://wp.looz.com/wp-content/themes/twentytwenty/style.css, Match: 'Version: 1.7'
 Checking Known Locations - Time: 00:00:13 <================================================================================================================================================================> (400 / 400) 100.00% Time: 00:00:13
[i] 3 theme(s) Identified.
[+] WPScan DB API OK
 [redacted]
 | Requests Done (during the scan): 13
 | Requests Remaining: 25
[+] Finished: Sat Jul 25 05:22:30 2026
[+] Requests Done: 417
[+] Cached Requests: 65
[+] Most response codes received: 404: 398, 401: 13, 200: 3, 500: 3
[!] Too many client errors (4xx). This could indicate access restrictions, authentication issues, or WAF blocking
[+] Data Sent: 109.614 KB
[+] Data Received: 87.417 KB
[+] Memory used: 198.656 MB
[+] Elapsed time: 00:00:33

The scan quickly flagged that the site is running an outdated WordPress 5.7.2 core from 2021, along with an active XML-RPC endpoint (xmlrpc.php) and an exposed readme.html file. The scan also found the external WP-Cron enabled and three outdated default themes (Twenty Twenty-One, Twenty Nineteen, and Twenty Twenty) sitting on old versions.

None

During the plugin enumeration phase, the scanner only detected Akismet plugin. The directory path (/wp-content/plugins/akismet/) threw a 403 Forbidden error, which just means directory listing is turned off. Because of that, the exact version number stayed hidden, meaning we can't immediately check for version-specific CVEs on it without digging deeper.

Code Analysis

None

I used the username and the password found in the comment, and accessed in the admin dashboard.

None

I prepared a reverse shell and checked the pages to upload it and finally found it haha

None None

But things didn't go as expected, and I couldn't upload the reverse shell using this method. But I tried to use Metasploit and it is also failed. Then I remembered that SSH service was also running, and I brute-forced SSH using the second admin username from the screenshot below.

None None

By bruteforcing the SSH credentials of the secondary administrator, I gained a foothold in the target system.

None

After securing my initial foothold, the next phase is privilege escalation😎 enumeration.

Checking current user and privileges

None

Checking OS version and kernel

None

Checking currently logged-in users and history

None

Finding SUID/SGID files

None None

🧐Hmm, standard Linux systems don't have a SUID binary named shell_testv1.0 in a user's home directory. The shell_testv1.0 has the SUID bit set (s) and is owned by root, any user on the system who executes this binary will temporarily run it with full root privileges. Let's run it !

None

Can privilege escalation be done here in another way?