Mr. Robot CTF — Complete Walkthrough

Introduction

The Mr. Robot CTF is a beginner/intermediate-level vulnerable virtual machine inspired by the Mr. Robot series.

The objective of this challenge is to compromise the machine and find three hidden keys located at different stages of the system.

In this walkthrough, I will cover the complete process, including:

• Connecting to the CTF network
• Reconnaissance
• Port scanning
• Web enumeration
• Finding the first key
• Discovering credentials
• Exploitation
• Obtaining a reverse shell
• Privilege escalation
• Finding the second and third keys

Step 1. Connect to our network

Connect to our network using OpenVPN.

Command :

sudo openvpn (thm file.ovpn)

Step 2. Reconnaissance

Used nmap.

There are 3 ports open: — 22/tcp, ssh — 80/tcp, http, Apache httpd — 443/tcp, ssl/http, Apache http

Step 3. Enumeration

Used gobuster.

Visited http://your thm ip /robots.txt.

Identified a dictionary named fsocity.dic and file: key-1-of-3.txt .

Visited http:// your thm ip/key-1-of-3.txt.

Yeh! Got the first key:

Visited http:// your thm ip/fsocity.dic.

Visited http://your thm ip/license

Inspected and got:

Used CyberChef. Identified elliot:ER28–0652.

Visited http://your thm ip/wp-login.php

Used the credentials found. Got access Elliot Alderson to panel.

Step 4 . Exploitation

Elliot is allowed to edit files! Edited 404.php file in Templates . Substituted its content by pentest monkey reverse shell , personalizing IP and Port. Hit Update File .

Used netcat to set up a listener.

Visited http://your thm ip/wp-includes/themes/TwentyFifteen/404.php.

Got the shell.

Not allowed to visualize key-2-of-3.txt.

Used cat.

Got robot:c3fcd3d76192e4007dfb496cca67e13b.

python -c 'import pty; pty.spawn("/bin/sh")'

su robot cat /home/robot/ckey-2-of-3.txt

Yeh ! Got key 2:

Step 5. Privilege Escalation

Looked for root permission.

Go to https://gtfobins.org/

searched for nmap SUID.

Ran nmap — interactive. Ran !sh.

There is the vulnerability /usr/bin/nmap in the machine

You got it by using the linpeas to exploit.

We are now root!

Got the root flag.