Mr. Robot-THM Writeup

Based on the Mr. Robot show.

NMAP Scan:

2 ports are open. i.e. 80, 443.

Checking robots .txt:

We will neegate to this key-1-of-3.txt toget the first key as shown in screenshot below:

As we can see there is also a wordlist i.e. fsocity.dic. First we will download this to our machine , when we go to this page in browser we can clearly see that certain word are repeated and the size is 6.19MB.Ater this we will use bash to filter out unique words and name the new file as dict.dic.

Directory Brute forcing:

gobuster dir -u http://10.10.232.57 -w /usr/share/wordlists/seclists/Discovery/Web-Content/directory-list-2.3-medium.txt -t 100

After this when try to login with username elliot:Passw0Rd this shows us error which confirms that indeed our given username is correct but we don’t have the correct password for this user :

We will use wpscan tool for bruteforcing this passsword with the list which we downloaded earlier and sore the output in wpscan.result file:

wpscan — url http://10.10.232.57 -U elliot -P dict.dic — password-attack wp-login -t 100 -o wpscan.result

Username: elliot, Password: ER28–0652

When we login to the CMS .We will uploadt php reverse shell on the Appearence →Editor and replace 404 Template with Pntester’monkey reverse shell.

https://github.com/pentestmonkey/php-reverse-shell/blob/master/php-reverse-shell.php

After uploading and saving this when we try to access any resource that is not available we will get a shell as shown below.Here i have used http://10.10.232.57/junk :

When we go inside robot directory it contains 2 files one is robot user’s hash and other key 2 but when i try to read contents of the key its giving me permission denied:

We will crack this hash to get password of robot user:

We have the password now we will change user to robot by using su robot and enter abcdefghijklmnopqrstuvwxyz as password:

The first line is to get a better shell:

python3 -c ‘import pty;pty.spawn(“/bin/bash”)’

We will have to privilege escalate to get 3rd key. We used find to see the files for which suid bit is set:

find / -perm -u=s -type f 2>/dev/null

We have nmap[suid bit set] we will use this to read the 3rd key.More information about this is available at gtfobin:

https://gtfobins.github.io/gtfobins/nmap/#suid