LinkedinGithub

Mr Robot 1

you can download the target machine from here

then after you download the mrRobot.ova file import it into either virtualbox or vmware for me i am using vmware

and then change the network settings for this machine and make it in the same network as your attack machine

i have set my attack kali machine to bridged and the IP Subnet is 192.168.11.0/24 so i made the network settings for the target machine also to bridged

the Mr Robot1 machine IP for me is 192.168.11.107

Enumeration

nmap

so we have closed ssh port and an apache web server at port 80 and 443

web server enumeration

let view what endpoints we have at /robots.txt directory

First Key

so the first key is at the directory key-1-of-3.txt that we have found at /robots.txt directory

and now go to /fsociety.dic directory and a file called fsociety.dic is downloaded

this looks like a custom wordlist let's see how much words it contains

800k is a lot so let's remove duplicates

If after we have removed the duplicates, we are left with a word list of ~11k words. Let’s save it for later.

Web server scanning using Nikto

and the scanning found a wordpress login page at /wp-login.php

Web server directory fuzzing

we can also find the wordpress login page by fuzzing the directories using gobuster or another similar tool like ffuf, dirbuster ...etc

so if we visit http://192.168.11.107/login we will be redirected to the wordpress login page

Bruteforcing Login Page using Hydra

if we enter invalid credentials it will say invalid username so we can enumerate valid usernames and when we find a valid one we can use it to find the valid password

intercept the request using burp (i used random credentials like admin:admin)

Now we know the parameters of the form, let’s use Hydra to brute force. Remember the fsociety dictionary file, this is going to come handy while using Hydra

Let’s break it down:

  • -L fsocity2 : Try all the usernames from the file fsocity.dic.uniq

  • -p invalidpass : Use an unique password, it doesn’t matter (we’re only interested in the username for now)

  • 192.168.11.107 : The IP of the machine we’re attacking

  • http-post-form : What we’re trying to brute force, here a HTTP POST form

  • ‘/wp-login.php:log=^USER^&pwd=^PASS^&wp-submit=Log+In:F=Invalid username’

    • /wp-login.php : The path to where the form is located

    • log=^USER^&pwd=^PASS^&wp-submit=Log+In : The POST parameters to send. ^USER^ and ^PASS^ are placeholders that will be replaced with the actual values.

    • F=Invalid username : Consider an attempt as a failure (F) if the response contains the text Invalid username

as a result we will get 3 valid usernames

if we log in with one of those usernames and a random password we will get this

next let's enumerate the password for the user elliot using hydra

as a result we will find a valid password

let's try now and login with elliot : ER28-0652

Foothold as user daemon

As you can see that we have gained access to the admin page of the WordPress site. We are not done yet as we need to get access to the server itself. For that, we get a reverse shell by uploading a reverse shell script.

I found a reverse shell script in PHP you can find it here, and edited it with my Host machine IP address and port that would be used for any incoming reverse connections.

now go to the dashboard in the left side menu click on Appearance -> Editor

now we will edit a php page and put our php reverse shell in it and then when we visit this page the php code will be executed and we will get a shell back

after pasting the rev shell code in the template make sure to save it by scrolling down to the end of the template code and you will find a button called update file

after this we have to execute the php code by visiting the link : http://192.168.11.07/404.php

but before doing so we have to setup a listener

now visit the link

and you should recieve a shell

upgrade shell

Lateral Movement -> from daemon to robot

let's go to the home directory and see which users are there

so there is only the user robot

if we look at his directory we will find 2 files the first is the second key which we don't have permissions to read and the second file is the password hash for the user robot

the hash type is MD5

let's upload this file to an online service called crackstation to crack this MD5 hash

Second Key

Privilege Escalation -> root

first let's do some enumeration using linpeas.sh

listing all the SUID binaries in the machine, nmap binary stands out

and the exploit is in gtfobins you can see it here

Third Key

hope you found this walkthrough easy to understand and follow

Greeting From Sayonara

Previoushow to make virtual box machines work in vmware also ?NextDFIR

Last updated

Was this helpful?