Mr Robot 1
Last updated
Was this helpful?
Last updated
Was this helpful?
you can download the target machine from here
then after you download the mrRobot.ova file import it into either virtualbox or vmware for me i am using vmware
and then change the network settings for this machine and make it in the same network as your attack machine
i have set my attack kali machine to bridged and the IP Subnet is 192.168.11.0/24 so i made the network settings for the target machine also to bridged
the Mr Robot1 machine IP for me is 192.168.11.107
so we have closed ssh port and an apache web server at port 80 and 443
let view what endpoints we have at /robots.txt directory
so the first key is at the directory key-1-of-3.txt that we have found at /robots.txt directory
and now go to /fsociety.dic directory and a file called fsociety.dic is downloaded
this looks like a custom wordlist let's see how much words it contains
800k is a lot so let's remove duplicates
If after we have removed the duplicates, we are left with a word list of ~11k words. Let’s save it for later.
and the scanning found a wordpress login page at /wp-login.php
we can also find the wordpress login page by fuzzing the directories using gobuster or another similar tool like ffuf, dirbuster ...etc
so if we visit http://192.168.11.107/login we will be redirected to the wordpress login page
if we enter invalid credentials it will say invalid username so we can enumerate valid usernames and when we find a valid one we can use it to find the valid password
intercept the request using burp (i used random credentials like admin:admin)
Now we know the parameters of the form, let’s use Hydra to brute force. Remember the fsociety dictionary file, this is going to come handy while using Hydra
Let’s break it down:
-L fsocity2 : Try all the usernames from the file fsocity.dic.uniq
-p invalidpass : Use an unique password, it doesn’t matter (we’re only interested in the username for now)
192.168.11.107 : The IP of the machine we’re attacking
http-post-form : What we’re trying to brute force, here a HTTP POST form
‘/wp-login.php:log=^USER^&pwd=^PASS^&wp-submit=Log+In:F=Invalid username’
/wp-login.php : The path to where the form is located
log=^USER^&pwd=^PASS^&wp-submit=Log+In : The POST parameters to send. ^USER^ and ^PASS^ are placeholders that will be replaced with the actual values.
F=Invalid username : Consider an attempt as a failure (F) if the response contains the text Invalid username
as a result we will get 3 valid usernames
if we log in with one of those usernames and a random password we will get this
next let's enumerate the password for the user elliot using hydra
as a result we will find a valid password
let's try now and login with elliot : ER28-0652
As you can see that we have gained access to the admin page of the WordPress site. We are not done yet as we need to get access to the server itself. For that, we get a reverse shell by uploading a reverse shell script.
I found a reverse shell script in PHP you can find it here, and edited it with my Host machine IP address and port that would be used for any incoming reverse connections.
now go to the dashboard in the left side menu click on Appearance -> Editor
now we will edit a php page and put our php reverse shell in it and then when we visit this page the php code will be executed and we will get a shell back
after pasting the rev shell code in the template make sure to save it by scrolling down to the end of the template code and you will find a button called update file
after this we have to execute the php code by visiting the link : http://192.168.11.07/404.php
but before doing so we have to setup a listener
now visit the link
and you should recieve a shell
upgrade shell
let's go to the home directory and see which users are there
so there is only the user robot
if we look at his directory we will find 2 files the first is the second key which we don't have permissions to read and the second file is the password hash for the user robot
the hash type is MD5
let's upload this file to an online service called crackstation to crack this MD5 hash
first let's do some enumeration using linpeas.sh
listing all the SUID binaries in the machine, nmap binary stands out
and the exploit is in gtfobins you can see it here
hope you found this walkthrough easy to understand and follow
Greeting From Sayonara
