TryHackMe: Mr. Robot CTF Walkthrough

1.Starting the machine 2.Reconnaissance 3.Web Enumeration 4.Gaining Admin Access 5.Reverse Shell 6.Privilege Escalation — Root 7.Flags

1.Start the Machine

Navigate to the Mr. Robot CTF room on TryHackMe Click "Start Machine" Wait for the machine to boot up (takes ~2–3 minutes) Note the Target IP Address displayed

2. Reconnaissance

The Mindset Before I start hacking, I need to understand what I'm dealing with I need to gather as much information as possible before making any moves.

My Goal Here: Find out:

What services are running on this machine?

What doors are open for me to enter?

Are there any clues left behind by the developers?

Step 1: Port Scanning I always start with a port scan. It's like walking around a building and checking which doors are unlocked.

nmap -sCV [TARGET_IP] -oA scan_results

-sCV Run default scanning scripts and Detect service versions -oA Save results in 3 formats

What This Tells Me

22 (SSH) — — — — OPEN — — OpenSSH 8.2p1 — SSH is OPEN! I can try to log in remotely! 80 (HTTP) — — — OPEN — — Apache httpd — — A website is running here 443 (HTTPS) — — OPEN — — Apache httpd — — A secure website is also running here

I have THREE open doors here SSH is open, which means I might be able to log in if I find credentials. But I also have a website running on ports 80 and 443. Websites often have vulnerabilities. I'll start with the website since it's usually the easiest way in

3.Web Enumeration

Visiting the Website

Next, I opened my browser and visited the website.

URL: http://TARGET_IP

What I Saw: The website showed a cool terminal interface — like a command prompt. It looked like something from the Mr. Robot TV show.

Now, Checking robots.txt

One of the first things I always check on any website is robots.txt.

What Is robots.txt? 1.It's a file that tells search engines (like Google) which pages to look at and which to ignore 2.But sometimes developers accidentally put sensitive files here 3.It's like leaving a map to your secret hiding spot

URL Checked:

What I Found:

User-agent: * fsocity.dic key-1-of-3.txt

What These Files Are:

fsocity.dic -> A wordlist (a big list of words, maybe usernames or passwords)

key-1-of-3.txt->The first flag I can just download it — no hacking needed!

Flag 1 — The Easiest Flag Ever I accessed the flag file directly in my browser

URL: http://TARGET_IP/key-1-of-3.txt

Finding Hidden Pages — Directory Enumeration

I wanted to find more hidden pages on the website. So I used a tool called gobuster.

What Does Gobuster Do?

It tries thousands of common folder names (like /admin, /login, /secret)

If any of them exist, Gobuster finds them

Think of it like trying every key on a keychain until one opens the door

Interesting Findings:

Path Found

/wp-login.php(WordPress login page! This is huge) /license(A license page — might have clues) /wp-admin/(WordPress admin area) /readme.html(WordPress info page)

4.Gaining Admin Access

The License Page: The /license page looked boring just some legal text. But something told me to check the page source. How to View Page Source:

Right-click anywhere on the page *Click "View Page Source"

What I Found in the Source Code:

Cm9ib3Q6IEVSMjgtMDY1Mg== (But it's actually Base64 encoded text)

Decoding the Secret Message:

Instead of using the command line, I used a free online tool called Base64 Decode (https://www.base64decode.org/). It's super easy — just paste the text and click decode!

Steps I Followed:

Went to https://www.base64decode.org/

Pasted Cm9ib3Q6IEVSMjgtMDY1Mg== into the input box

Clicked the decode button

Got the result instantly!

The Result:

elliot:ER28–0652

Access WordPress Admin Panel Login URL: http://[TARGET_IP]/wp-login.php

Credentials:

Username: elliot

Password: ER28–0652

Successful Login, We now have admin access to the WordPress site.

5.Reverse Shell

Step 1: Find Theme Editor Navigation Path: WordPress Admin Dashboard → Appearance → Theme Editor Why This Works:

WordPress allows admin users to edit theme files

We can inject malicious PHP code to get a shell

Step 2: Select a Template File File Chosen: archive.php (or 404.php)

Reasoning: These files are accessible via the browser and will execute our PHP payload.

Step 3: Inject Reverse Shell Payload Payload USED: PentestMonkey PHP Reverse Shell

Set Up Netcat Listener

nc -lvnp 5555

Trigger the Reverse Shell

Generate 404 Error ,like I have Done this

Catch the Shell

Upgrade to a Fully Interactive TTY Shell The Problem: The shell I caught with Netcat is very basic. I can't use commands like su, nano, or vim. Tab completion doesn't work. It's like using a phone with a cracked screen — functional, but painful.

The Solution: Spawn a proper TTY (terminal) shell using Python.

Command Used:

python -c 'import pty; pty.spawn("/bin/bash")'

6.Privilege Escalation

Step 1: Explore the System

ls -la /home

what I Get Is

drwxr-xr-x 4 root root 4096 . drwxr-xr-x 3 root root 4096 .. drwxr-xr-x 2 robot robot 4096 robot

Step 2: Check Robot's Home Directory

ls -la /home/robot

rw-r — r — 1 robot robot 33 key-2-of-3.txt -rw-r — r — 1 robot robot 397 password.raw-md5

Findings:

key-2-of-3.txt → The second flag (but we can't read it yet)

password.raw-md5 → Contains a password hash(We can Crack it with crackstation.net)

Step 3: Find SUID Binaries Instead of trying to become the robot user first, I decided to look for SUID binaries right away. SUID binaries run with the owner's privileges ,if owned by root, they run as root

find / -perm -u=s -type f 2>/dev/null

My Scan Results:

There's /usr/local/bin/nmap with SUID Nmap is a network scanning tool, but if it has SUID and is owned by root, I can use it to get a root shell

Step 4: Exploit Nmap — Root Access

/usr/local/bin/nmap — interactive

Enter Interactive Mode:

nmap> !sh

Result:

WE ARE NOW ROOT

What Just Happened:

nmap — interactive → Opens Nmap in interactive mode

!sh → This command spawns a shell from within Nmap

Because Nmap has SUID and is owned by root, the shell runs as root

Step 5: Now I Can Do Anything — Grab All the Flags!

Since I'm root, I have access to Everthing. I can now read both remaining flags

Flag 2 Location:

cat /home/robot/key-2-of-3.txt

NOW ,Flag 3 Location:

cat /root/key-3-of-3.txt

All Flags Found

Flag 1 — -073403c8a58a1f80d943455fb30724b9

Flag 2 — -822c73956184f694993bede3eb39f959

Flag 3— -04787ddef27c3dee1ee161b21670b4e4

My Actual Attack Path

Step 1: Got reverse shell as daemon ↓ Step 2: Spawned TTY shell ↓ Step 3: Found SUID nmap ↓ Step 4: Exploited nmap → Got root shell ↓ Step 5: Read /home/robot/key-2-of-3.txt → Flag 2 ↓ Step 6: Read /root/key-3-of-3.txt → Flag 3

My Path was faster and simpler

I expected to spend time cracking passwords and switching users, but I went straight to root instead! The SUID nmap was the shortcut I didn't know existed. This is why privilege escalation is so important — sometimes one small misconfiguration is all you need