🎩Mr Robot

Can you root this Mr. Robot styled machine? This is a virtual machine meant for beginners/intermediate users. There are 3 hidden keys located on the machine, can you find them?

1.Reconnaisance

1.1 Nmap

Using nmap to scan and identify open ports and services

Webpage

  • Navigating to the webpage, we get a cool interactive shell-like environment with references to the series Mr Robot. Really fun to play with this and explore the given commands to find more references to the show.

2. Scanning

2.1 Gobuster

  • Using Gobuster to brute-force directories.

  • We see a lot of directories and from the list we can find out that it is a WordPress site. We also see /robots.txt which might contain some interesting folders

/robots.txt

  • Navigating to robots.txt

  • We get two new directories fsocity.dic and key-1-of-3.txt

/fsocity.dic

  • We get a dictionary file, possibly useful for brute-forcing later on

Key 1 : http://10.10.20.163/key-1-of-3.txt

3. Gaining Access

3.1 wp-login

  • In order to login to the /wp-login.php, we need admin credentials sop that we can upload our reverse shell and gain access to the box.

  • For every wrong username, we find the we get an error Invalid username

  • Further inspecting the request in burpsuite, we can see that the username and password values are stored in variables log and pwd and sent to the server respectively

3.2 Hydra

  • We can use hydra and the corresponding error messages along with the fsocity.dic file wordlist to brute-force username and password.

  • The wordlist contains over 850000 words. In order to save time, we can filter repeats from fsocity.dic and save the filtered (and much smaller) list to fsocity_filtered.dic which reduces the number of words to just under 11500

  • Using hydra and the error message, we can brute-force the username with fsocity_filtered.dic wordlist and by keeping the password static(In this instance as test)

We get the username Elliot

  • Now using the username, we try to login again, and get another error he password you entered for the username Elliot is incorrect

  • With this error message, we repeat the brute-forcing attack on the password with fsocity_filtered.dic w3ordlist, this time using Elliot as the username.

We get the login credentials, Elliot : ER28-0652

3.3 Reverse Shell

  • Login in to the portal, we can upload the php -reverse-shell from pentestmonkey in Appearance > Editor > Header (make sure to change the IP address)

  • Starting netcat and executing the reverse shell to get a connection

  • Stabilizing the shell

  • Using find to serch for any file names starting with key-

  • We get a hit for key-2-of-3.txt located in the home directory of user robot

  • We do not have the permission to access the key as the current user, but we do get access to user robot's md5 password hash

3.4 John

  • Saving the md5 hash to a file name raw-md5.txt in the attacker machine

  • Using john to crack the password of robot

We get the credentials robot : abcdefghijklmnopqrstuvwxyz

  • Login in as robot and getting key-2-of-3.txt

4.Privilege Escalation

  • Finding any SUID files for privilege escalation

  • We can see that SUID is set on /usr/local/bin/nmap

  • Escalating permissions with nmap with the help of gtfobins.

  • Reading key-3-of-3.txt

PreviousJack-of-All-TradesNextOverpass

Last updated