DEV Community

Laach_
Laach_

Posted on

Mr Robot CTF - THM

#linux #ctf #cybersecurity #tutorial

Machine Info

Difficulty: Medium🟧
Link: HERE
Avg time: 30 Minutes
OS: Linux

Description: Based on the Mr. Robot show, can you root this box?

Recon

An Nmap scan was performed to discover open ports and services.

sudo nmap 10.10.166.171 -T5 -sV --min-rate 1000 --max-retries 3
Enter fullscreen mode Exit fullscreen mode

nmap scan

Scan reveals:

  • 22/tcp - SSH
  • 80/tcp - HTTP
  • 443/tcp - HTTPs

Port 80 was checked first. Only a pseudo-terminal was found there, with nothing useful inside. Port 443 showed the same content. Nothing useful was found on the website itself.

pseudo web terminal

Enumeration

Since browsing revealed nothing useful, ffuf was used to search for hidden content.

sudo ffuf -u "http://10.10.166.171/FUZZ" -w /usr/share/seclists/Discovery/Web-Content/raft-large-files.txt -c -t 50
Enter fullscreen mode Exit fullscreen mode

Files characteristic of WordPress were found. This gave important information about the CMS running on the machine.

First Key

A robots.txt file was found and checked. It contained references to fsociety.dic and key-1-of-3.txt. The first key was grabbed simply by accessing the file through the browser.

robots.txt

Log as Elliot

With the first key obtained, a way into the system was needed. WordPress login was checked. Since a login form existed at wp-login, Turbo Intruder was used to brute-force usernames. A valid user was found: elliot.

Only the password was missing. fsociety.dic contained 850k entries, so the list was deduplicated:

sort fsociety.dic | uniq > fsociety_no_dupes.dic
Enter fullscreen mode Exit fullscreen mode

This reduced the wordlist to 11k entries, roughly 85 times smaller than the original. Turbo Intruder was run again against the login form, and the password ER28-0652 was found.

Shell as daemon

As an authenticated WordPress user, a reverse shell can usually be obtained through Appearance → Editor → 404.php.

first and second step

third step

Malicious PHP code was injected into 404.php. A payload from revshells was used, specifically the PHP PentestMonkey reverse shell. A listener was set up first.

sudo nc -nvlp 9999
Enter fullscreen mode Exit fullscreen mode

The shell was then triggered by accessing the modified 404 template.

http://10.10.166.171/wp-content/themes/twentyfifteen/404.php
Enter fullscreen mode Exit fullscreen mode

A shell as the daemon user was obtained.

Shell as robot

Before continuing, the shell was upgraded to a proper TTY with a Python one-liner.

python -c 'import pty; pty.spawn("/bin/bash")'
Enter fullscreen mode Exit fullscreen mode

INFO: Different tools would be used today. This writeup was originally created a long time ago, just never published.

Colors were added for readability.

export TERM=xterm && export PS1='\\[\\e[1;38;5;79m\\]\\u@\\h\\[\\e[1;37m\\]:\\[\\e[1;38;5;33m\\]\\w\\[\\e[1;37m\\]\\$ \\[\\e[0m\\]'
Enter fullscreen mode Exit fullscreen mode

Custom colors can be set as preferred.

With a shell as daemon, the home directories were checked. A directory for the user robot was found and inspected. The file password.raw-md5 was present, containing robot:[MD5 PASSWORD]. The hash was cracked using crackstation, and the resulting password was used to log in as robot with su robot.

robot home folder

INFO: Logging in as robot may cause shell issues. Reusing the earlier TTY upgrade commands fixes this.

Second key

After logging in as robot, the key file was read directly.

cat /home/robot/key-2-of-3.txt
Enter fullscreen mode Exit fullscreen mode

Shell as root

SUID binaries were checked first for privilege escalation potential.

find / -type f -perm -4000 2>/dev/null
Enter fullscreen mode Exit fullscreen mode

Most SUID files found were standard for Linux. One stood out as suspicious: /usr/local/bin/nmap, with the SUID bit set.

SUIDs

gtfobins was checked for a way to abuse SUID Nmap for privilege escalation.

/usr/local/bin/nmap --interactive
Enter fullscreen mode Exit fullscreen mode

Interactive mode allowed command execution as root.

nmap> !sh
Enter fullscreen mode Exit fullscreen mode

Root access was obtained.

Third Key

Directory navigation was limited at this point, but the last key was still reachable. Contents of /root were listed.

ls -l /root
Enter fullscreen mode Exit fullscreen mode

root folder

The key was read with cat.

cat /root/key-3-of-3.txt
Enter fullscreen mode Exit fullscreen mode

Interesting

A direct escalation from daemon to root was tested afterward, skipping the robot user entirely. The SUID Nmap trick worked the same way, confirming that the robot user can be bypassed entirely if the nmap SUID is found early.

Top comments (0)