MrRobot

Mr Robot

Room link: https://tryhackme.com/room/mrrobot

Key 1

As always, for my first scan I used an aggressive NMAP scan.

ajread@aj-ubuntu:~/TryHackMe$ nmap -A [Remote IP]
Starting Nmap 7.80 ( https://nmap.org ) at 2022-02-18 23:12 EST
Nmap scan report for [Remote IP]
Host is up (0.14s latency).
Not shown: 997 filtered ports
PORT    STATE  SERVICE  VERSION
22/tcp  closed ssh
80/tcp  open   http     Apache httpd
|_http-server-header: Apache
|_http-title: Site doesn't have a title (text/html).
443/tcp open   ssl/http Apache httpd
|_http-server-header: Apache
|_http-title: Site doesn't have a title (text/html).
| ssl-cert: Subject: commonName=www.example.com
| Not valid before: 2015-09-16T10:45:03
|_Not valid after:  2025-09-13T10:45:03

Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 38.77 seconds

It appears I am working with ssh and http/https on this box.

I used gobuster to enumerate port 80. It returned a LOT of hits. Just from looking at the website, there was a lot going on so I kind of expected that.

From gobuster, there appears to be a robots.txt file. I used curl to investigate the page and found that key-1-of-3.txt is referenced there.

I can run curl http://[Remote IP]/key-1-of-3.txt to get the first key, done!

Key 2

The output of the directory enumeration (gobuster) also pointed me to the /license directory. If I navigate to the site, it appears to supply some base64 encoded string at the bottom of the page.

The base64 encoded string decodes to elliot:ER28-0652. This looks like credentials! Also, it appears there is a login page at /wp-login. Out of curiosity, I tried the newly found credentials on the page and they worked! The site drops me into what appears to be a user blog dashboard run by Wordpress version 4.3.1. I do some research and find that I can use this method: https://www.hackingarticles.in/wordpress-reverse-shell/ to upload a reverse shell. It looks like I could also go the metasploit route. But, let's be adventerous today and try the manual way. The php reverse shell that I use is from pentest monkey on github: https://github.com/pentestmonkey/php-reverse-shell. I made sure to change the IP and port the shell to point back to me local/attack machine.

With everything in place and following the directions from the hackingarticles site, I start a netcat listener on my local machine.

I run a curl command from my local machine to call the updated php theme that, in reality, is my php reverse shell (https://www.hackingarticles.in/wordpress-reverse-shell/).

And it drops me into a shell as daemon!

I make sure to upgrade the shell with python.

If I navigate to the home folder of user robot, I find some interesting files that I dont have access to, except for one.

The password.raw-md5 appears to be an MD5 hash of the user robot's credentials. I dropped the hash into crackstation (https://crackstation.net/) and found the password for user robot. With the password, I am able to authenticate as robot and read key 2!

Key 3

Key 3 probably requires privilege escalation. I wanted to see if I could use a GTFO bin to execute a binary as root user and gain its privilege. I used find / -perm +6000 2>/dev/null to do so, which checks for files with SGID/SUID bit set.

Analyzing the output of the command, it looks like I can priv esc using nmap (/usr/local/bin/nmap) in interactive mode (https://vk9-sec.com/nmap-privilege-escalation/).

Nmap has some cool commands in interactive mode that I didnt know about.

Running a command with ! at the beginning allows me to run a shell command. And like that, I can read the last key!

PreviousJack-of-All-TradesNextOverpass

Last updated