Mr-Robot: 1 — VulnHub Walkthrough | My First Hands-on CTF Experience

Introduction

In this article, I'm sharing my hands-on experience with Mr-Robot: 1, a vulnerable machine available on VulnHub.

The main goal of this challenge is to find three hidden flags by performing reconnaissance, web enumeration, gaining initial access, and exploring Linux privilege escalation.

I worked on this machine in my own lab environment using Kali Linux and VirtualBox.

During the challenge, I was able to find two out of the three flags. Unfortunately, I couldn't complete the final stage because my laptop became unresponsive while I was working with a Netcat listener.

Even though I couldn't capture all three flags, it was a good learning experience. I got practical exposure to different techniques and understood how they work in a real-world testing environment.

I'll explain my approach step by step

Lab Setup

Before starting the challenge, I prepared an isolated virtual lab environment to perform the assessment safely.

Tools and Environment

Tool : Purpose

VirtualBox : To run virtual machines

Kali Linux : To perform security testing and enumeration

Mr-Robot : 1Vulnerable target machine

Nmap : To discover active hosts and identify open ports

WPScan : To enumerate the WordPress application

Netcat : To establish network connections during the lab

Network Configuration

I configured both Kali Linux and Mr-Robot: 1 on a Host-Only network in VirtualBox.

I also configured a NAT adapter for Kali Linux to access the internet when required.

The target machine remained isolated from the external network.

Lab Details

• Attacker Machine: Kali Linux
• Target Machine: Mr-Robot: 1
• Hypervisor: Oracle VirtualBox
• Network: Host-Only Adapter
• Target IP: 192.168.56.4
• Kali Linux IP: 192.168.56.3

Network Discovery

After configuring the lab environment, my first step was to identify the target machine's IP address.

I used Nmap's host discovery option to identify active devices on the Host-Only network.

Command Used

sudo nmap -sn 192.168.56.0/24

Explanation

• sudo – Runs the command with administrator privileges.
• nmap – Network scanning tool.
• -sn – Performs host discovery without a port scan.
• 192.168.56.0/24 – Scans the local network range.

Result

The scan identified multiple active devices on the network. After identifying my Kali Linux IP address and checking the available hosts, I identified 192.168.56.4 as the Mr-Robot: 1 target machine.

Target IP: 192.168.56.4

This completed the initial network discovery stage.

Port Scanning Using Nmap

After identifying the target IP address, I performed a port scan to identify open ports and running services.

I used Nmap with service version detection to gather information about the target.

Command Used

sudo nmap -Pn -sV 192.168.56.4

Command Explanation

• sudo – Executes the command with administrator privileges.
• nmap – Network scanning tool.
• -Pn – Skips host discovery and treats the target as online.
• -sV – Detects service versions running on open ports.
• 192.168.56.4 – Target machine IP address.

Scan Results

PortStateService22ClosedSSH80OpenHTTP443OpenHTTPS

The scan also reported 997 filtered TCP ports.

Analysis

Port 80 and port 443 were open, indicating that the target was running a web application accessible through HTTP and HTTPS.

Based on these results, I decided to investigate the web application further.

Web Enumeration

After identifying ports 80 and 443 as open, I moved to web enumeration to explore the target's web application.

I opened Firefox in Kali Linux and entered the target IP address:

http://192.168.56.4

Observation

The website displayed a Mr-Robot-themed introductory page with a message:

"Hello friend… Today your education begins."

The page also displayed several commands and references related to the fsociety theme.

Analysis

This confirmed that a web application was running on the target machine.

Username Enumeration and Password Testing

During the enumeration process, I investigated possible WordPress usernames. One of the usernames I worked with was elliot.

Preparing the Password Wordlist

During the challenge, I discovered a dictionary file named fsocity.dic.

Instead of directly using the original file, I processed it to create a cleaner and more organized wordlist.

I performed the following operations:

1. Extracted the fsocity.dic file.
2. Sorted the entries.
3. Removed duplicate entries.
4. Saved the processed results in a new file named filtered.txt.

This helped reduce duplicate password entries and created a unique wordlist for further testing.

Password Testing Using WPScan

I used WPScan to test the identified username against the processed wordlist in my isolated lab environment.

Command Used

wpscan --url http://192.168.56.4/ -U elliot -P filtered.txt --no-update

Command Explanation

• wpscan – WordPress security scanning tool.
• --url – Specifies the target WordPress application.
• -U elliot – Specifies the username to test.
• -P filtered.txt – Specifies the processed password wordlist.
• --no-update – Skips the database update check.

Successful Password Discovery

After preparing the filtered wordlist, I used WPScan to perform password testing against the identified WordPress username elliot.

During this process, I successfully identified the correct password from the wordlist.

This demonstrated how weak or guessable passwords can put user accounts at risk when proper password security controls are not implemented.

WordPress Login

After identifying the correct password for the elliot account, I proceeded to investigate the WordPress login functionality.

I used the discovered credentials to attempt authentication through the WordPress login page.

This step helped me understand how WordPress authentication works and how weak credentials can potentially lead to unauthorized access.

Initial Access

After investigating the WordPress authentication process, I moved towards the initial access stage.

The objective of this stage was to understand how application-level access could potentially be used to obtain command execution on the underlying Linux system.

Challenges Faced During the Lab

While working on the Mr-Robot: 1 machine, I faced a few challenges. Everything didn't go smoothly, especially because I was running the vulnerable machine and Kali Linux on my laptop.

Some of the challenges I faced were:

1. Security Warnings: While handling the intentionally vulnerable Mr-Robot machine, I encountered security warnings from Windows Defender. Since the machine is designed to contain vulnerabilities, I had to be careful while handling the VM and keep my lab environment isolated.
2. Laptop Performance: Running multiple virtual machines and performing security testing increased the resource usage on my laptop. Sometimes the system became very slow or unresponsive.
3. Brute-Force Testing: During password testing with WPScan and my processed wordlist, my laptop struggled to handle the workload. This affected the smooth progress of the testing.
4. Netcat Issue: During the final flag stage, I attempted to use the Netcat listener (nc -lvnp). However, my laptop became unresponsive, and I couldn't continue with the process.

Limitations

• I was able to discover only two out of the three hidden flags.
• Due to my laptop's hardware limitations, I couldn't complete the final stage.
• I couldn't fully investigate and troubleshoot the Netcat issue.
• I couldn't complete the entire challenge within my available system resources.

What I Learned

This hands-on challenge helped me gain practical experience with:

• Network discovery using Nmap.
• Port and service enumeration.
• Web application enumeration.
• WordPress security testing using WPScan.
• Wordlist processing and password testing.
• Understanding initial access and privilege escalation concepts.

Although I couldn't complete all three flags, this experience helped me improve my practical cybersecurity knowledge and understand the importance of troubleshooting in penetration testing.

Conclusion

Working on the Mr-Robot: 1 VulnHub machine was a valuable hands-on learning experience.

Throughout this challenge, I explored different stages of a penetration testing exercise, including network discovery, port scanning, web enumeration, WordPress security testing, and password testing.

I successfully discovered two out of the three hidden flags. Although I couldn't complete the final stage due to system performance limitations, the experience helped me understand the practical challenges involved in cybersecurity labs.

This challenge motivated me to continue improving my Linux, networking, web application security, and penetration testing skills.

I believe practical lab exercises like this are important for building a strong foundation in cybersecurity.

Acknowledgement

Thanks to the VulnHub community for providing this vulnerable machine for cybersecurity practice.