Trilocor Robotics Ltd. (“Trilocor” herein) invited you to a private assessment to perform a targeted Web Application Penetration Test of Trilocor’s externally facing web applications to identify high-risk security weaknesses, determine the impact to Trilocor, document all findings in a clear and repeatable manner, and provide remediation recommendations.
The following types of findings are in-scope for this assessment:

* Sensitive or personally identifiable information disclosure

* Cross-Site Scripting (XSS)

* Remote Code Execution (RCE)

* Arbitrary file upload

* All forms of session attacks

* All forms of server-side attacks (excluding DoS ones)

* Authentication or authorization flaws, such as insecure direct object references (IDOR) and authentication bypasses

* All forms of injection vulnerabilities

* Directory traversal

* Local file read

* Significant security misconfigurations and business logic flaws

* Exposed credentials that could be leveraged to gain further access

The following types of activities are considered out-of-scope for this assessment:

* Scanning and assessing any other IP in the Entry Point's network

* Physical attacks against Trilocor properties

* Unverified scanner output

* Man-in-the-Middle attacks

* Any vulnerabilities identified through DDoS or spam attacks

* Self-XSS

* Login/logout CSRF

* Issues with SSL certificates, open ports, TLS versions, or missing HTTP response headers

* Vulnerabilities in third-party libraries unless they can be leveraged to significantly impact the target

* Any theoretical attacks or attacks that require significant user interaction or low risk

Scope
The scope of this assessment is as follows:

* www.trilocor.local, any identified *.trilocor.local subdomain and any open web server ports discovered on the "Entry Point" IP address that will become visible upon pressing "SPAWN INSTANCE" (Step 2 below).

* Scanning any other IP in the Entry Point's network is NOT allowed!

* Five (5) different applications exist, as well as simulated users in certain application locations that you can attack.

URL
Description
www.trilocor.local
Main Trilocor website
Discover the port
PR website
Discover the port
Jobs portal
Discover the port
HR website
Discover the port
Online shop
Connectivity Prerequisites
If you are using Pwnbox to conduct your exam web application security assessment activities, please make sure that eu-academy-exams-X or us-academy-exams-X is visible when opening a terminal. Then and only then Pwnbox will be able to reach the exam lab's applications. If you see otherwise, you will need to terminate any spawned Pwnbox in a module and spawn a new one from inside the exam lab's page (Step 1 below).
If you are using your own attacking virtual machine to connect to the exam lab's VPN, then you can test your connectivity by adding an entry regarding www.trilocor.local in your virtual machine's hosts file and browsing http://www.trilocor.local.
Exam Objectives
To be awarded the HTB Certified Web Exploitation Specialist (HTB CWES) certification you must:

* Obtain a minimum of 80 points by successfully completing the tasks below AND

* Compose and submit a commercial-grade report including all identified vulnerabilities, evidence of successful exploitation (in a step-by-step manner), and remediation advice, based on the provided report template.

 
 
 
TASK1
Try to gain access to the admin dashboard of Trilocor's main website to read the flag. (10 points)
 
TASK2
Try to gain remote code execution on Trilocor's main website to read the (.txt) flag in the '/' directory. (5 points)
 
TASK3
Try to bypass the login screen on Trilocor's HR dashboard application to read the flag. (5 points)
 
TASK4
Try to gain remote code execution on Trilocor's HR dashboard application to read the (.txt) flag in the '/' directory. (15 points)
 
TASK5
Try to gain access to the admin panel of Trilocor's Jobs Portal to read the flag. (10 points)
 
TASK6
Try to gain remote code execution on Trilocor's Jobs Portal to read the (.txt) flag in the '/' directory. (10 points)
 
TASK7
Try to gain access to Trilocor's PR admin panel to read the flag. (5 points)
 
TASK8
Try to gain remote code execution on Trilocor's PR admin panel to read the (.txt) flag in the '/' directory. (15 points)
 
TASK9
Try to gain admin access on Trilocor's Shop to read the flag. (10 points)
 
TASK10
Try to gain remote code execution on the Trilocor Shop application to read the (.txt) flag in the '/' directory. (15 points)
 
 
 
 
 
 
vi /etc/hosts
10.129.205.208 www.trilocor.local trilocor.local
 
 
 
 
nmap -sS -Pn -n --open -p- 10.129.205.208 --min-rate 3000
 
nmap -sS -Pn -n --open -p- 10.129.205.208 --min-rate 3000
Starting Nmap 7.93 ( https://nmap.org ) at 2026-01-01 18:14 KST
Nmap scan report for 10.129.205.208
Host is up (0.21s latency).
Not shown: 65528 closed tcp ports (reset), 2 filtered tcp ports (no-response)
Some closed ports may be reported as filtered due to --defeat-rst-ratelimit
PORT     STATE SERVICE
80/tcp   open  http
8009/tcp open  ajp13
8080/tcp open  http-proxy
8088/tcp open  radan-http
9000/tcp open  cslistener
 
Nmap done: 1 IP address (1 host up) scanned in 22.53 seconds
 
 
 
 
[Jan 01, 2026 - 18:17:56 (KST)] exegol-pentest /workspace # nmap -sC -sV -Pn -n --open -p80,8009,8080,8088,9000 10.129.205.208 --min-rate 3000 -oA cwes_svc
Starting Nmap 7.93 ( https://nmap.org ) at 2026-01-01 18:18 KST
Nmap scan report for 10.129.205.208
Host is up (0.21s latency).
 
PORT     STATE SERVICE VERSION
80/tcp   open  http    Apache httpd 2.4.41 ((Ubuntu))
|_http-title: Did not follow redirect to http://www.trilocor.local/
|_http-server-header: Apache/2.4.41 (Ubuntu)
8009/tcp open  http    nginx
| http-cookie-flags:
|   /:
|     PHPSESSID:
|_      httponly flag not set
|_http-title: Trilocor Public Relations
|_ajp-methods: Failed to get a valid response for the OPTION request
8080/tcp open  http    Apache httpd 2.4.54 ((Unix))
|_http-open-proxy: Proxy might be redirecting requests
| http-title: Trilocor - Job Portal
|_Requested resource was /login.php
|_http-server-header: Apache/2.4.54 (Unix)
8088/tcp open  http    Apache httpd 2.4.41 ((Ubuntu))
|_http-server-header: Apache/2.4.41 (Ubuntu)
|_http-title: Human Resources - Login
9000/tcp open  http    nginx
|_http-title: TRILOCOR Shop | Home
 
Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 20.47 seconds
 
 
 
 
[Jan 01, 2026 - 18:20:46 (KST)] exegol-pentest /workspace # curl -s -i http://www.trilocor.local/robots.txt
HTTP/1.1 200 OK
Date: Thu, 01 Jan 2026 09:21:06 GMT
Server: Apache/2.4.41 (Ubuntu)
Link: <http://www.trilocor.local/index.php/wp-json/>; rel="https://api.w.org/"
Vary: Accept-Encoding
Content-Length: 118
Content-Type: text/plain; charset=utf-8
 
User-agent: *
Disallow: /wp-admin/
Allow: /wp-admin/admin-ajax.php
 
Sitemap: http://www.trilocor.local/wp-sitemap.xml
 
 
 
 
 
[Jan 01, 2026 - 18:29:50 (KST)] exegol-pentest /workspace # curl -s -i http://www.trilocor.local/wp-login.php | sed -n '1,20p'
 
HTTP/1.1 403 Forbidden
Date: Thu, 01 Jan 2026 09:33:10 GMT
Server: Apache/2.4.41 (Ubuntu)
Content-Length: 283
Content-Type: text/html; charset=iso-8859-1
 
<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN">
<html><head>
<title>403 Forbidden</title>
</head><body>
<h1>Forbidden</h1>
<p>You don't have permission to access this resource.</p>
<hr>
<address>Apache/2.4.41 (Ubuntu) Server at www.trilocor.local Port 80</address>
</body></html>
 
 
 
 
 
 
 
[Jan 01, 2026 - 18:28:46 (KST)] exegol-pentest /workspace # curl -s -i http://www.trilocor.local/wp-json/wp/v2/users
HTTP/1.1 200 OK
Date: Thu, 01 Jan 2026 09:29:03 GMT
Server: Apache/2.4.41 (Ubuntu)
X-Robots-Tag: noindex
Link: <http://www.trilocor.local/index.php/wp-json/>; rel="https://api.w.org/"
X-Content-Type-Options: nosniff
Access-Control-Expose-Headers: X-WP-Total, X-WP-TotalPages, Link
Access-Control-Allow-Headers: Authorization, X-WP-Nonce, Content-Disposition, Content-MD5, Content-Type
X-WP-Total: 1
X-WP-TotalPages: 1
Allow: GET
Vary: Origin
Content-Length: 643
Content-Type: application/json; charset=UTF-8
 
[{"id":1,"name":"web-admin","url":"http:\/\/www.trilocor.local","description":"","link":"http:\/\/www.trilocor.local\/index.php\/author\/web-admin\/","slug":"web-admin","avatar_urls":{"24":"http:\/\/2.gravatar.com\/avatar\/b3b777a4d9b45d225796292eea0cdade?s=24&d=mm&r=g","48":"http:\/\/2.gravatar.com\/avatar\/b3b777a4d9b45d225796292eea0cdade?s=48&d=mm&r=g","96":"http:\/\/2.gravatar.com\/avatar\/b3b777a4d9b45d225796292eea0cdade?s=96&d=mm&r=g"},"meta":[],"_links":{"self":[{"href":"http:\/\/www.trilocor.local\/index.php\/wp-json\/wp\/v2\/users\/1"}],"collection":[{"href":"http:\/\/www.trilocor.local\/index.php\/wp-json\/wp\/v2\/users"}]}}]#
 
 
 
 
[Jan 01, 2026 - 18:38:10 (KST)] exegol-pentest /workspace # curl -s http://www.trilocor.local/ \
 | grep -Eo 'wp-content/(plugins|themes)/[^/"]+' \
 | sort -u
 
wp-content/plugins/elementor
wp-content/themes/astra
 
 
 
 
[Jan 01, 2026 - 18:56:31 (KST)] exegol-pentest /workspace # curl -X POST -i http://www.trilocor.local/xmlrpc.php \
  -d "<methodCall><methodName>system.listMethods</methodName></methodCall>"
HTTP/1.1 200 OK
Date: Thu, 01 Jan 2026 09:56:36 GMT
Server: Apache/2.4.41 (Ubuntu)
Connection: close
Vary: Accept-Encoding
Content-Length: 4272
Content-Type: text/xml; charset=UTF-8
 
<?xml version="1.0" encoding="UTF-8"?>
<methodResponse>
  <params>
    <param>
      <value>
      <array><data>
  <value><string>system.multicall</string></value>
  <value><string>system.listMethods</string></value>
  <value><string>system.getCapabilities</string></value>
  <value><string>demo.addTwoNumbers</string></value>
  <value><string>demo.sayHello</string></value>
  <value><string>pingback.extensions.getPingbacks</string></value>
  <value><string>pingback.ping</string></value>
  <value><string>mt.publishPost</string></value>
  <value><string>mt.getTrackbackPings</string></value>
  <value><string>mt.supportedTextFilters</string></value>
  <value><string>mt.supportedMethods</string></value>
  <value><string>mt.setPostCategories</string></value>
  <value><string>mt.getPostCategories</string></value>
  <value><string>mt.getRecentPostTitles</string></value>
  <value><string>mt.getCategoryList</string></value>
  <value><string>metaWeblog.getUsersBlogs</string></value>
  <value><string>metaWeblog.deletePost</string></value>
  <value><string>metaWeblog.newMediaObject</string></value>
  <value><string>metaWeblog.getCategories</string></value>
  <value><string>metaWeblog.getRecentPosts</string></value>
  <value><string>metaWeblog.getPost</string></value>
  <value><string>metaWeblog.editPost</string></value>
  <value><string>metaWeblog.newPost</string></value>
  <value><string>blogger.deletePost</string></value>
  <value><string>blogger.editPost</string></value>
  <value><string>blogger.newPost</string></value>
  <value><string>blogger.getRecentPosts</string></value>
  <value><string>blogger.getPost</string></value>
  <value><string>blogger.getUserInfo</string></value>
  <value><string>blogger.getUsersBlogs</string></value>
  <value><string>wp.restoreRevision</string></value>
  <value><string>wp.getRevisions</string></value>
  <value><string>wp.getPostTypes</string></value>
  <value><string>wp.getPostType</string></value>
  <value><string>wp.getPostFormats</string></value>
  <value><string>wp.getMediaLibrary</string></value>
  <value><string>wp.getMediaItem</string></value>
  <value><string>wp.getCommentStatusList</string></value>
  <value><string>wp.newComment</string></value>
  <value><string>wp.editComment</string></value>
  <value><string>wp.deleteComment</string></value>
  <value><string>wp.getComments</string></value>
  <value><string>wp.getComment</string></value>
  <value><string>wp.setOptions</string></value>
  <value><string>wp.getOptions</string></value>
  <value><string>wp.getPageTemplates</string></value>
  <value><string>wp.getPageStatusList</string></value>
  <value><string>wp.getPostStatusList</string></value>
  <value><string>wp.getCommentCount</string></value>
  <value><string>wp.deleteFile</string></value>
  <value><string>wp.uploadFile</string></value>
  <value><string>wp.suggestCategories</string></value>
  <value><string>wp.deleteCategory</string></value>
  <value><string>wp.newCategory</string></value>
  <value><string>wp.getTags</string></value>
  <value><string>wp.getCategories</string></value>
  <value><string>wp.getAuthors</string></value>
  <value><string>wp.getPageList</string></value>
  <value><string>wp.editPage</string></value>
  <value><string>wp.deletePage</string></value>
  <value><string>wp.newPage</string></value>
  <value><string>wp.getPages</string></value>
  <value><string>wp.getPage</string></value>
  <value><string>wp.editProfile</string></value>
  <value><string>wp.getProfile</string></value>
  <value><string>wp.getUsers</string></value>
  <value><string>wp.getUser</string></value>
  <value><string>wp.getTaxonomies</string></value>
  <value><string>wp.getTaxonomy</string></value>
  <value><string>wp.getTerms</string></value>
  <value><string>wp.getTerm</string></value>
  <value><string>wp.deleteTerm</string></value>
  <value><string>wp.editTerm</string></value>
  <value><string>wp.newTerm</string></value>
  <value><string>wp.getPosts</string></value>
  <value><string>wp.getPost</string></value>
  <value><string>wp.deletePost</string></value>
  <value><string>wp.editPost</string></value>
  <value><string>wp.newPost</string></value>
  <value><string>wp.getUsersBlogs</string></value>
</data></array>
      </value>
    </param>
  </params>
</methodResponse>
 
 
 
 
 
[Jan 01, 2026 - 19:09:03 (KST)] exegol-pentest /workspace # wpscan --url http://www.trilocor.local --usernames web-admin --passwords /usr/share/wordlists/rockyou.txt
_______________________________________________________________
         __          _______   _____
         \ \        / /  __ \ / ____|
          \ \  /\  / /| |__) | (___   ___  __ _ _ __ ®
           \ \/  \/ / |  ___/ \___ \ / __|/ _` | '_ \
            \  /\  /  | |     ____) | (__| (_| | | | |
             \/  \/   |_|    |_____/ \___|\__,_|_| |_|
 
         WordPress Security Scanner by the WPScan Team
                         Version 3.8.28
 
       @_WPScan_, @ethicalhack3r, @erwan_lr, @firefart
_______________________________________________________________
 
[i] Updating the Database ...
[i] Update completed.
 
[+] URL: http://www.trilocor.local/ [10.129.205.208]
[+] Started: Thu Jan  1 19:09:16 2026
 
Interesting Finding(s):
 
[+] Headers
 | Interesting Entry: Server: Apache/2.4.41 (Ubuntu)
 | Found By: Headers (Passive Detection)
 | Confidence: 100%
 
[+] robots.txt found: http://www.trilocor.local/robots.txt
 | Interesting Entries:
 |  - /wp-admin/
 |  - /wp-admin/admin-ajax.php
 | Found By: Robots Txt (Aggressive Detection)
 | Confidence: 100%
 
[+] XML-RPC seems to be enabled: http://www.trilocor.local/xmlrpc.php
 | Found By: Direct Access (Aggressive Detection)
 | Confidence: 100%
 | References:
 |  - http://codex.wordpress.org/XML-RPC_Pingback_API
 |  - https://www.rapid7.com/db/modules/auxiliary/scanner/http/wordpress_ghost_scanner/
 |  - https://www.rapid7.com/db/modules/auxiliary/dos/http/wordpress_xmlrpc_dos/
 |  - https://www.rapid7.com/db/modules/auxiliary/scanner/http/wordpress_xmlrpc_login/
 |  - https://www.rapid7.com/db/modules/auxiliary/scanner/http/wordpress_pingback_access/
 
[+] The external WP-Cron seems to be enabled: http://www.trilocor.local/wp-cron.php
 | Found By: Direct Access (Aggressive Detection)
 | Confidence: 60%
 | References:
 |  - https://www.iplocation.net/defend-wordpress-from-ddos
 |  - https://github.com/wpscanteam/wpscan/issues/1299
 
[+] WordPress version 6.0.2 identified (Insecure, released on 2022-08-30).
 | Found By: Rss Generator (Passive Detection)
 |  - http://www.trilocor.local/index.php/feed/, <generator>https://wordpress.org/?v=6.0.2</generator>
 |  - http://www.trilocor.local/index.php/comments/feed/, <generator>https://wordpress.org/?v=6.0.2</generator>
 
[+] WordPress theme in use: astra
 | Location: http://www.trilocor.local/wp-content/themes/astra/
 | Last Updated: 2025-12-16T00:00:00.000Z
 | Readme: http://www.trilocor.local/wp-content/themes/astra/readme.txt
 | [!] The version is out of date, the latest version is 4.11.18
 | Style URL: http://www.trilocor.local/wp-content/themes/astra/style.css
 | Style Name: Astra
 | Style URI: https://wpastra.com/
 | Description: Astra is fast, fully customizable & beautiful WordPress theme suitable for blog, personal portfolio,...
 | Author: Brainstorm Force
 | Author URI: https://wpastra.com/about/?utm_source=theme_preview&utm_medium=author_link&utm_campaign=astra_theme
 |
 | Found By: Urls In Homepage (Passive Detection)
 | Confirmed By: Urls In 404 Page (Passive Detection)
 |
 | Version: 3.9.2 (80% confidence)
 | Found By: Style (Passive Detection)
 |  - http://www.trilocor.local/wp-content/themes/astra/style.css, Match: 'Version: 3.9.2'
 
[+] Enumerating All Plugins (via Passive Methods)
[+] Checking Plugin Versions (via Passive and Aggressive Methods)
 
[i] Plugin(s) Identified:
 
[+] elementor
 | Location: http://www.trilocor.local/wp-content/plugins/elementor/
 | Last Updated: 2025-12-22T12:28:00.000Z
 | [!] The version is out of date, the latest version is 3.34.0
 |
 | Found By: Urls In Homepage (Passive Detection)
 |
 | Version: 3.7.7 (100% confidence)
 | Found By: Query Parameter (Passive Detection)
 |  - http://www.trilocor.local/wp-content/plugins/elementor/assets/js/frontend.min.js?ver=3.7.7
 | Confirmed By:
 |  Readme - Stable Tag (Aggressive Detection)
 |   - http://www.trilocor.local/wp-content/plugins/elementor/readme.txt
 |  Readme - ChangeLog Section (Aggressive Detection)
 |   - http://www.trilocor.local/wp-content/plugins/elementor/readme.txt
 
[+] Enumerating Config Backups (via Passive and Aggressive Methods)
 Checking Config Backups - Time: 00:00:08 <=> (137 / 137) 100.00% Time: 00:00:08
 
 
 
 
 
 
[Jan 01, 2026 - 19:41:31 (KST)] exegol-pentest /workspace # ffuf -u http://trilocor.local/wp-admin/FUZZ -w `fzf-wordlists` -e .php -ac -c
 
        /'___\  /'___\           /'___\
       /\ \__/ /\ \__/  __  __  /\ \__/
       \ \ ,__\\ \ ,__\/\ \/\ \ \ \ ,__\
        \ \ \_/ \ \ \_/\ \ \_\ \ \ \ \_/
         \ \_\   \ \_\  \ \____/  \ \_\
          \/_/    \/_/   \/___/    \/_/
 
       v2.1.0
________________________________________________
 
 :: Method           : GET
 :: URL              : http://trilocor.local/wp-admin/FUZZ
 :: Wordlist         : FUZZ: /usr/share/dirb/wordlists/common.txt
 :: Extensions       : .php
 :: Follow redirects : false
 :: Calibration      : true
 :: Timeout          : 10
 :: Threads          : 40
 :: Matcher          : Response status: 200-299,301,302,307,401,403,405,500
________________________________________________
 
                        [Status: 302, Size: 0, Words: 1, Lines: 1, Duration: 2340ms]
about.php               [Status: 302, Size: 0, Words: 1, Lines: 1, Duration: 7588ms]
admin.php               [Status: 302, Size: 0, Words: 1, Lines: 1, Duration: 1389ms]
admin.php               [Status: 302, Size: 0, Words: 1, Lines: 1, Duration: 1400ms]
 
 
 
 
 
GET /wp-login.php?redirect_to=http%3A%2F%2Fwww.trilocor.local%2Fwp-admin%2Fadmin.php&reauth=1 HTTP/1.1
Host: www.trilocor.local
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:128.0) Gecko/20100101 Firefox/128.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Upgrade-Insecure-Requests: 1
Priority: u=0, i
 
 
 
 
 
 
 
[Jan 01, 2026 - 20:45:46 (KST)] exegol-pentest /workspace # curl -i "http://www.trilocor.local/wp-login.php"
HTTP/1.1 403 Forbidden
Date: Thu, 01 Jan 2026 11:58:46 GMT
Server: Apache/2.4.41 (Ubuntu)
Content-Length: 283
Content-Type: text/html; charset=iso-8859-1
 
<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN">
<html><head>
<title>403 Forbidden</title>
</head><body>
<h1>Forbidden</h1>
<p>You don't have permission to access this resource.</p>
<hr>
<address>Apache/2.4.41 (Ubuntu) Server at www.trilocor.local Port 80</address>
</body></html>
 
 
 
 
 
 
[Jan 01, 2026 - 21:19:22 (KST)] exegol-pentest /workspace # curl -si http://www.trilocor.local/wp-admin/admin-ajax.php     
HTTP/1.1 400 Bad Request
Date: Thu, 01 Jan 2026 12:19:52 GMT
Server: Apache/2.4.41 (Ubuntu)
X-Robots-Tag: noindex
Expires: Wed, 11 Jan 1984 05:00:00 GMT
Cache-Control: no-cache, must-revalidate, max-age=0
Content-Length: 1
Connection: close
Content-Type: text/html; charset=UTF-8
 
0#
 
 
 
 
-------
 
 
[Jan 01, 2026 - 21:46:34 (KST)] exegol-pentest /workspace # ffuf -w `fzf-wordlists` -H "Host:FUZZ.trilocor.local" -u http://www.trilocor.local/ -ic -c
 
        /'___\  /'___\           /'___\
       /\ \__/ /\ \__/  __  __  /\ \__/
       \ \ ,__\\ \ ,__\/\ \/\ \ \ \ ,__\
        \ \ \_/ \ \ \_/\ \ \_\ \ \ \ \_/
         \ \_\   \ \_\  \ \____/  \ \_\
          \/_/    \/_/   \/___/    \/_/
 
       v2.1.0
________________________________________________
 
 :: Method           : GET
 :: URL              : http://www.trilocor.local/
 :: Wordlist         : FUZZ: /opt/lists/seclists/Discovery/DNS/bitquark-subdomains-top100000.txt
 :: Header           : Host: FUZZ.trilocor.local
 :: Follow redirects : false
 :: Calibration      : false
 :: Timeout          : 10
 :: Threads          : 40
 :: Matcher          : Response status: 200-299,301,302,307,401,403,405,500
________________________________________________
 
admin                   [Status: 200, Size: 5599, Words: 223, Lines: 88, Duration: 357ms]
 
 
 
 
 
 
 
 
http://admin.trilocor.local/
 
 
 
 
 
[Jan 01, 2026 - 21:46:24 (KST)] exegol-pentest /workspace # curl -s http://admin.trilocor.local
<!DOCTYPE html>
        <html lang="en-US">
        <head>
        <meta http-equiv="Content-Type" content="text/html; charset=UTF-8" />
        <title>Log In &lsaquo; Trilocor &#8212; WordPress</title>
        <meta name='robots' content='max-image-preview:large, noindex, noarchive' />
<link rel='dns-prefetch' href='//s.w.org' />
<link rel='stylesheet' id='dashicons-css'  href='http://admin.trilocor.local/wp-includes/css/dashicons.min.css?ver=6.0.2' media='all' />
<link rel='stylesheet' id='buttons-css'  href='http://admin.trilocor.local/wp-includes/css/buttons.min.css?ver=6.0.2' media='all' />
<link rel='stylesheet' id='forms-css'  href='http://admin.trilocor.local/wp-admin/css/forms.min.css?ver=6.0.2' media='all' />
<link rel='stylesheet' id='l10n-css'  href='http://admin.trilocor.local/wp-admin/css/l10n.min.css?ver=6.0.2' media='all' />
<link rel='stylesheet' id='login-css'  href='http://admin.trilocor.local/wp-admin/css/login.min.css?ver=6.0.2' media='all' />
        <meta name='referrer' content='strict-origin-when-cross-origin' />
                <meta name="viewport" content="width=device-width" />
                </head>
        <body class="login no-js login-action-login wp-core-ui  locale-en-us">
        <script type="text/javascript">
                document.body.className = document.body.className.replace('no-js','js');
        </script>
                <div id="login">
                <h1><a href="https://wordpress.org/">Powered by WordPress</a></h1>
 
                <form name="loginform" id="loginform" action="http://admin.trilocor.local/wp-login.php" method="post">
                        <p>
                                <label for="user_login">Username or Email Address</label>
                                <input type="text" name="log" id="user_login" class="input" value="" size="20" autocapitalize="off" autocomplete="username" />
                        </p>
 
                        <div class="user-pass-wrap">
                                <label for="user_pass">Password</label>
                                <div class="wp-pwd">
                                        <input type="password" name="pwd" id="user_pass" class="input password-input" value="" size="20" autocomplete="current-password" />
                                        <button type="button" class="button button-secondary wp-hide-pw hide-if-no-js" data-toggle="0" aria-label="Show password">
                                                <span class="dashicons dashicons-visibility" aria-hidden="true"></span>
                                        </button>
                                </div>
                        </div>
                                                <p class="forgetmenot"><input name="rememberme" type="checkbox" id="rememberme" value="forever"  /> <label for="rememberme">Remember Me</label></p>
                        <p class="submit">
                                <input type="submit" name="wp-submit" id="wp-submit" class="button button-primary button-large" value="Log In" />
                                                                        <input type="hidden" name="redirect_to" value="http://admin.trilocor.local/wp-admin/" />
                                                                        <input type="hidden" name="testcookie" value="1" />
                        </p>
                </form>
 
                                        <p id="nav">
                                                                <a href="http://admin.trilocor.local/wp-login.php?action=lostpassword">Lost your password?</a>
                        </p>
                                        <script type="text/javascript">
                        function wp_attempt_focus() {setTimeout( function() {try {d = document.getElementById( "user_login" );d.focus(); d.select();} catch( er ) {}}, 200);}
wp_attempt_focus();
if ( typeof wpOnload === 'function' ) { wpOnload() }            </script>
                                <p id="backtoblog">
                        <a href="http://admin.trilocor.local/">&larr; Go to Trilocor</a>                </p>
                        </div>
                        <script src='http://admin.trilocor.local/wp-includes/js/jquery/jquery.min.js?ver=3.6.0' id='jquery-core-js'></script>
<script src='http://admin.trilocor.local/wp-includes/js/jquery/jquery-migrate.min.js?ver=3.3.2' id='jquery-migrate-js'></script>
<script id='zxcvbn-async-js-extra'>
var _zxcvbnSettings = {"src":"http:\/\/admin.trilocor.local\/wp-includes\/js\/zxcvbn.min.js"};
</script>
<script src='http://admin.trilocor.local/wp-includes/js/zxcvbn-async.min.js?ver=1.0' id='zxcvbn-async-js'></script>
<script src='http://admin.trilocor.local/wp-includes/js/dist/vendor/regenerator-runtime.min.js?ver=0.13.9' id='regenerator-runtime-js'></script>
<script src='http://admin.trilocor.local/wp-includes/js/dist/vendor/wp-polyfill.min.js?ver=3.15.0' id='wp-polyfill-js'></script>
<script src='http://admin.trilocor.local/wp-includes/js/dist/hooks.min.js?ver=c6d64f2cb8f5c6bb49caca37f8828ce3' id='wp-hooks-js'></script>
<script src='http://admin.trilocor.local/wp-includes/js/dist/i18n.min.js?ver=ebee46757c6a411e38fd079a7ac71d94' id='wp-i18n-js'></script>
<script id='wp-i18n-js-after'>
wp.i18n.setLocaleData( { 'text direction\u0004ltr': [ 'ltr' ] } );
</script>
<script id='password-strength-meter-js-extra'>
var pwsL10n = {"unknown":"Password strength unknown","short":"Very weak","bad":"Weak","good":"Medium","strong":"Strong","mismatch":"Mismatch"};
</script>
<script src='http://admin.trilocor.local/wp-admin/js/password-strength-meter.min.js?ver=6.0.2' id='password-strength-meter-js'></script>
<script src='http://admin.trilocor.local/wp-includes/js/underscore.min.js?ver=1.13.3' id='underscore-js'></script>
<script id='wp-util-js-extra'>
var _wpUtilSettings = {"ajax":{"url":"\/wp-admin\/admin-ajax.php"}};
</script>
<script src='http://admin.trilocor.local/wp-includes/js/wp-util.min.js?ver=6.0.2' id='wp-util-js'></script>
<script id='user-profile-js-extra'>
var userProfileL10n = {"user_id":"0","nonce":"ea584adfea"};
</script>
<script src='http://admin.trilocor.local/wp-admin/js/user-profile.min.js?ver=6.0.2' id='user-profile-js'></script>
                        <script>
                        /(trident|msie)/i.test(navigator.userAgent)&&document.getElementById&&window.addEventListener&&window.addEventListener("hashchange",function(){var t,e=location.hash.substring(1);/^[A-z0-9_-]+$/.test(e)&&(t=document.getElementById(e))&&(/^(?:a|select|input|button|textarea)$/i.test(t.tagName)||(t.tabIndex=-1),t.focus())},!1);
                        </script>
                                <div class="clear"></div>
        </body>
        </html>
        #
 
 
 
 
 
 
[Jan 01, 2026 - 22:32:15 (KST)] exegol-pentest /workspace # wpscan --url http://admin.trilocor.local --usernames web-admin --passwords `fzf-wordlists` --password-attack xmlrpc -t 20
_______________________________________________________________
         __          _______   _____
         \ \        / /  __ \ / ____|
          \ \  /\  / /| |__) | (___   ___  __ _ _ __ ®
           \ \/  \/ / |  ___/ \___ \ / __|/ _` | '_ \
            \  /\  /  | |     ____) | (__| (_| | | | |
             \/  \/   |_|    |_____/ \___|\__,_|_| |_|
 
         WordPress Security Scanner by the WPScan Team
                         Version 3.8.28
       Sponsored by Automattic - https://automattic.com/
       @_WPScan_, @ethicalhack3r, @erwan_lr, @firefart
_______________________________________________________________
 
[+] URL: http://admin.trilocor.local/ [10.129.205.208]
[+] Started: Thu Jan  1 22:59:53 2026
 
Interesting Finding(s):
 
[+] Headers
 | Interesting Entry: Server: Apache/2.4.41 (Ubuntu)
 | Found By: Headers (Passive Detection)
 | Confidence: 100%
 
[+] robots.txt found: http://admin.trilocor.local/robots.txt
 | Interesting Entries:
 |  - /wp-admin/
 |  - /wp-admin/admin-ajax.php
 | Found By: Robots Txt (Aggressive Detection)
 | Confidence: 100%
 
[+] XML-RPC seems to be enabled: http://admin.trilocor.local/xmlrpc.php
 | Found By: Direct Access (Aggressive Detection)
 | Confidence: 100%
 | References:
 |  - http://codex.wordpress.org/XML-RPC_Pingback_API
 |  - https://www.rapid7.com/db/modules/auxiliary/scanner/http/wordpress_ghost_scanner/
 |  - https://www.rapid7.com/db/modules/auxiliary/dos/http/wordpress_xmlrpc_dos/
 |  - https://www.rapid7.com/db/modules/auxiliary/scanner/http/wordpress_xmlrpc_login/
 |  - https://www.rapid7.com/db/modules/auxiliary/scanner/http/wordpress_pingback_access/
 
[+] The external WP-Cron seems to be enabled: http://admin.trilocor.local/wp-cron.php
 | Found By: Direct Access (Aggressive Detection)
 | Confidence: 60%
 | References:
 |  - https://www.iplocation.net/defend-wordpress-from-ddos
 |  - https://github.com/wpscanteam/wpscan/issues/1299
 
[+] WordPress version 6.0.2 identified (Insecure, released on 2022-08-30).
 | Found By: Emoji Settings (Passive Detection)
 |  - http://admin.trilocor.local/a6a1910.html, Match: 'wp-includes\/js\/wp-emoji-release.min.js?ver=6.0.2'
 | Confirmed By: Meta Generator (Passive Detection)
 |  - http://admin.trilocor.local/a6a1910.html, Match: 'WordPress 6.0.2'
 
 
 
 지금 태스크 1 에서 막혀있는데, 풀이 방법을 알려줘.