MR.ROBOT THM

After a long break from tackling TryHackMe boxes, I decided to dive into the “Mr. Robot” challenge. The box, inspired by the popular TV show.

First scan the Ip address

we got a webpage on port 80. Try robot.txt to find what directories are listed there.

we got 2 directories. fsocity.dic consists of names and words that are repeated. can be used for bruteforce attack when needed.

we also got the first key.

Lets perform subdomain enumeration.

we got wp-login.php. Since its based on a show lets try the character name.

Now we know that the user elliot exists. lets bruteforce the login page with the word list we got from robots.txt. Since its wordpress i have used wpscan.

now lets login to the webpage.

Get Dante’s stories in your inbox

Join Medium for free to get updates from this writer.

Remember me for faster sign in

now we need to gain a reverse shell. Lets navigate to appearance/editor/404 template. now replace the script with php_reverse_shell script and change the ip address to our vm.

open a nc listener nc -lnvp 1234.

then navigate to the url that contains the 404 template

now navigate to home/robot directory. we find two files one is key-2-of-3.txt and password.raw-md5. we dont have permission to view the key but we can view the password.raw-mad5.

Now we decrypt the md5 hash.

we now have the password for the user robot.

now we move to user robot and view the key-2-of-3.txt.

Time for privilege escalation.

Lets try sudo -l. we dont have permission to run sudo. Lets view the SUID permissions of the files with this command

find /usr -type f -perm -4000 2>/dev/null

we find nmap in the list.

lets move into the interactive mode and use linux commands by using !sh

Now we can read the key-3–of-3.txt.

The box was a lot of fun, offering a challenging and engaging experience with its unique problems.