TryHackMe|MrRobotCTF WriteUp\Walkthrough (English)

Mr Robot CTF

 Room Link: https://tryhackme.com/r/room/mrrobot

================================================================

• First, do an Nmap scan. You have 2 ports open 80 and 443. We will focus on port 80. After doing gobuter you got a bunch of pages, the pages that we are concerned about are /robots.txt and /admin.

• The admin page is a WordPress login page. If you try to put any username there you will notice that the page tells you if the user is correct or not, which is a huge mistake and at the same time a huge benefit for us, as we can enumerate the usernames then the password, which will make the process much easier.

• If you look at the /robots.txt you will find two entries. One of which is the first key✨, and the other is a dictionary file, which we will use in our brute force. Once you go to the dictionary file page it will be downloaded automatically.

• Using the fsocity.dic we will enumerate the username using hydra.

We took the error text from the error message that appeared when we entered a wrong username, as shown in step 2.

• Now that we have the username, we can enumerate the password with the same dictionary. Capture the post request using burpsuite to take all the necessary information to make the hydra command. The error message will be The password you entered for the username or it can be S=302 noting (found redirect code), both of them will work properly.

• Use these credentials to login. Once you are in, from the left-side pane click on appearance >> Editor. Then from the right-side pane (Templates) choose 404 Template. Change the php code there with the php shell from pentestmonkey, then click Update File. Set up a listener on your attacking machine. To activate the shell, you need to go to any non-existing page, this will give a call back to your machine rather than rendering the 404 page.

• Once you get the shell, stable it then cd /home there is only one user robot. In robot’s home directory you have 2 files.

The second flag which you can’t read and the other password file. From the name you can assume that this file has been hashed using md5, to crack it use any website, such as http://crackstation.net , the password is *******************, use this password to change to robot using su robot. Now that you are robot you can read the second key ✨.

• The remaining task is to get root in order to get key 3. Upload linpeas.sh to the victim’s /tmp directory and then run it. You will have two 95% PE points.

The first one is related to the kernel, it won’t work. Now look at the other PE point, which is an SUID nmap binary !!!.

If you search in GTFObins for nmap you will get the steps to get root shell.

This way you got root and retrieved the 3^rd and last key ✨.