TryHackMe(THM)-Mrrobot Writeup
Tags: security, cybersecurity, hacking, tryhackme
Published: 2022-04-21 13:27:23




![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/qfol9yvrxh4y0qbudx3p.jpeg)

## Mr Robot CTF
**Based on the Mr. Robot show, can you root this box?**
Room link is here [link](https://tryhackme.com/room/mrrobot)

![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/tlijbeilh86f44fch23c.png)
_Can you root this Mr. Robot styled machine? This is a virtual machine meant for beginners/intermediate users. There are 3 hidden keys located on the machine, can you find them?_


## Let’s start the room with basic things.
**PORT SCANNING:**
![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/p2w2eb2vhaytwni1ou7t.jpg)


![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/sfqi4xx663k29wlz4dp0.png)
 

```
nmap -sV -sC -A IP
```

1. Port 22 – SSH  
2. Port 80 – http
3. Port 443 – ssl/http


Now, let's check out the webserver!



![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/64py9zjzmeluvv0faw02.png)
With the commands displayed here you can’t do anything which that would be help you.

## **If you haven’t seen the show yet, I recommend you do not try these commands, as they contain spoilers!**

On this page we don’t have any information to help us, so I decided to do a gobuster scan ( directory search ).

![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/apb7qcvvie6z8plop6q6.png)

```
gobuster dir -u IP -w /usr/share/wordlists/dirb/common.txt
```
The first hint for the first question is **“Robots”**
And we have the directory **“robots.txt”**



![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/dteplawg48g7on98tdxi.png)

Here is the first KEY!


![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/f8rw3t3czp4fgor411rk.png)

From this point I've found 2 ways to find the next key:

1. From the gobuster scan, we found a wordpress admin login page and on /robots.txt is a file “fsocity.dic” -> is a wordlist which we can use to bruteforce wordpress login page (This is a waste of time)

2. There is another interesting directory -> /license

 

![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/8y105etyngnxqroa877q.png)

If we scroll down we find a string in base64


![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/v36y7yjseyk11aly736l.png)

We can decode this on [BASE64 DECODER](https://base64.guru/converter/decode/text)

> https://base64.guru/converter/decode/text
ZWxsaW90OkVSMjgtMDY1Mgo= --> **elliot:ER28-0652**
And easy, we have the credentials for wordpress:

![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/6vmr77a4pyqsijgdr0h3.png)

![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/lp1ewjpggh3s4lw74krq.png)

Now the tricky part, and my favourite part of this room
We need to do a reverse shell:
First go to “Appearance” – “Editor” – “Archives”


![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/kwrgy42rf9otld8t2isz.png)

At this step, we have to replace the code that comes up with the reverse php shell component that we can copy from Github.
[PHP REVERSE SHELL](https://github.com/pentestmonkey/php-reverse-shell)


![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/pvbov7o1me9itffuayqr.png)


To connect to the shell you have to listen the port 4444 ( or the port you have chosen )
**NETCAT**

```
nc -lvnp 4444
```

And go on IP/wp-content/themes/twentyfifteen/archive.php
to activate the shell.


![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/sm9p6t673929z8jdeb10.png)


![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/dltj0b4nsr69bi0ns31k.jpg)
**Wohoo, we have a shell now.**

I added:

```
echo "import pty; pty.spawn('/bin/bash')" > /tmp/anyname.py
python /tmp/anyname.py
```
to have a stable shell.

The second key is in **/home/robot/**, but unfortunately we dont have permission to read this.

![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/wsiuzo3o31hcbalkdmp8.png)

Luckily there is another file with the password for robot user.

![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/pc9go8sbazhjuxccf216.png)
To decrypt this hash we use JohnTheRipper.

```
echo 'c3fcd3d76192e4007dfb496cca67e13b' > anyfilename
john --format=raw-md5 --wordlist=rockyou.txt anyfilename
john --show --format=RAW-MD5 anyfilename

> ?: abcdefghijklmnopqrstuvwxyz (this is the password)
```
Now, simply conenct as "robot".

```
su robot
-and the password is **abcdefghijklmnopqrstuvwxyz**
```

![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/s3q38x0bc17sz5f8uaru.png)

Now it remains to find the last key that should be in root.
The hint is _NMAP_

I used 

```
find / -perm -u=s -type f 2>/dev/null
```
to find all files who have SUID bit set.


![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/hui3kgdcu01anxsgew8s.png)
And yep, the nmap is here.


**GTFOBINS** is the best site in my opinion to find how to get root privilege access
[LINK](https://gtfobins.github.io/gtfobins/nmap/)
These are the comamnds to obtain root access:

```
nmap --interactive
nmap> !sh
```



![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/n609k4ka52odwhkloz3l.png)

**Finally we found the final key!!!**

It's a pretty old challenge, but a very good one. I hope you learned a lot from this writeup.
For any queries, feel free to drop a comment and follow me here for more ctf writeups.