Mr Robot CTF
Based on the Mr. Robot show, can you root this box?
Last updated
Based on the Mr. Robot show, can you root this box?
Last updated
Subscription Required
False [Free]
Type
Challenges (CTF)
Difficulty
Medium
Tags
MrRobot, Root, Beginner
No answer needed
No answer needed
No answer needed
No answer needed
HINT: Robots
fsocity.dic
key-1-of-3.txt
key-1-of-3.txt contains the first flag:
Next run dirb, dirbuster, or gobuster against the target to find some interesting URLs:
/0 opened a wordpress blog. Going to the login screen http://TARGET_IP/wp-login.php shows the wordpress login screen. Entering the username 'admin' and the password 'admin' presents an error message:
ERROR: Invalid username.
ERROR: The password you entered for the username elliot is incorrect.
Looking at fsocity.dic there are a number of duplicate entries so we can strip those out to optimise the wordlist:
You should find the password around the 5000th attempt.
HINT: White coloured font
Once logged into wordpress as an admin we can check out the image gallery. One image has white text in the background which reveals another username and also their password:
Start a netcat listener on your machine then open the 404.php page in a browser to trigger the reverse shell.
With a shell we can extract the md5 hash from password.raw-md5 from the daemon /home/robot/ directory:
c3fcd3d76192e4007dfb496cca67e13b
md5
(expand below)
Trying to cat key-2-of-3.txt we find that we don't have adequate permissions:
Trying to run su results in an error message saying we need to run it in a terminal
To get past this we need to upgrade our shell to a TTY shell:
HINT: nmap
The final flag is in the root directory so in order to reach that we need to privilege escalate our current shell. Searching the filesystem for files with the SUID bit set we find that nmap is installed and SUID is set:
GTFOBins shows the steps to run nmap in interactive mode which you can abuse to run commands as root:
With root shell we can access the root directory and obtain our final flag!
Running or against the target returns two open ports on port 80 and 443.
Checking the file shows two interesting files:
This page can be used to enumerate valid usernames as when providing the username 'elliot' () the error states the password is wrong:
We can then use , , or (slow) to brute force the password.
In order to turn our wordpress access into a shell we can edit the templates to add the reverse shell pointing to your tun0 IP address into the 404.php template file:
We can reverse the hash using :
073403c8a58a1f80d943455fb30724b9
822c73956184f694993bede3eb39f959
04787ddef27c3dee1ee161b21670b4e4
