{"id":73,"date":"2025-04-22T07:00:53","date_gmt":"2025-04-22T07:00:53","guid":{"rendered":"https:\/\/hackingwithj.com\/?p=73"},"modified":"2025-04-22T07:00:53","modified_gmt":"2025-04-22T07:00:53","slug":"vm-mr-robot","status":"publish","type":"post","link":"https:\/\/hackingwithj.com\/?p=73","title":{"rendered":"VM: Mr Robot"},"content":{"rendered":"\n<p class=\"wp-block-paragraph\">Capture The Flag (CTF) challenges are one of the best ways to grow as a security enthusiast or aspiring penetration tester. They throw you into real-life scenarios where you have to think creatively, make smart assumptions, and often fail before you succeed. This blog post walks through one such CTF I attempted, covering everything from initial enumeration to full root access.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">As a beginner, I\u2019m still learning and sometimes rely on public writeups when I get stuck. That\u2019s part of the process \u2014 understanding <strong>why<\/strong> something works and applying that knowledge to the next challenge. In this particular case, I got to play with web scanning, brute-forcing, shell access, and even privilege escalation via <strong>SUID binaries<\/strong>.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Let\u2019s dive in!<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">Scanning the Target<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">The first step in any penetration test or CTF is scanning. I ran an <strong>Nmap scan<\/strong> to gather information about the machine, checking for open ports, service versions, and other useful information that could hint at potential vulnerabilities.<\/p>\n\n\n\n<pre class=\"wp-block-code has-vivid-purple-color has-text-color has-link-color wp-elements-0d7a0f1c54e6537b66df28749bed8907\"><code>$ nmap 192.168.68.66 -sV -T4 -v -A<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">Here\u2019s what the flags mean:<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>-sV<\/strong>: Detects service versions.<\/li>\n\n\n\n<li><strong>-T4<\/strong>: Speeds up the scan by adjusting timing.<\/li>\n\n\n\n<li><strong>-v<\/strong>: Verbose output.<\/li>\n\n\n\n<li><strong>-A<\/strong>: Aggressive scan to detect OS and services.<\/li>\n<\/ul>\n\n\n\n<p class=\"wp-block-paragraph\">This showed the following open ports:<\/p>\n\n\n\n<figure class=\"wp-block-image size-large is-resized\"><img loading=\"lazy\" decoding=\"async\" width=\"1024\" height=\"498\" src=\"https:\/\/hackingwithj.com\/wp-content\/uploads\/2025\/04\/Schermafbeelding-2025-04-15-103607-1024x498.png\" alt=\"\" class=\"wp-image-74\" style=\"width:921px;height:auto\" srcset=\"https:\/\/hackingwithj.com\/wp-content\/uploads\/2025\/04\/Schermafbeelding-2025-04-15-103607-1024x498.png 1024w, https:\/\/hackingwithj.com\/wp-content\/uploads\/2025\/04\/Schermafbeelding-2025-04-15-103607-300x146.png 300w, https:\/\/hackingwithj.com\/wp-content\/uploads\/2025\/04\/Schermafbeelding-2025-04-15-103607-768x373.png 768w, https:\/\/hackingwithj.com\/wp-content\/uploads\/2025\/04\/Schermafbeelding-2025-04-15-103607.png 1062w\" sizes=\"auto, (max-width: 1024px) 100vw, 1024px\" \/><\/figure>\n\n\n\n<p class=\"wp-block-paragraph\">This gave me a list of open ports, and I noticed that a <strong>web server<\/strong> was running on the target machine. Time to open it in a browser!<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">Web Application Discovery<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">The web app was simple, but I immediately started exploring it. It had some <strong>JavaScript<\/strong> running, so I decided to dig deeper and see what other parts of the web application I could access. I then ran a <strong>Nikto scan<\/strong> to check for any obvious vulnerabilities or misconfigurations.<\/p>\n\n\n\n<pre class=\"wp-block-code has-vivid-purple-color has-text-color has-link-color wp-elements-e5eb50a52e252445a04f9211e42f538f\"><code>$ nikto -host 192.168.68.66<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">Nikto discovered several <strong>WordPress-related paths<\/strong>, so I followed up with <strong>WPScan<\/strong>:<\/p>\n\n\n\n<pre class=\"wp-block-code has-vivid-purple-color has-text-color has-link-color wp-elements-5ed2f3e17b17171bc1b0d66e0f027af4\"><code>$ wpscan --url 192.168.68.66<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">WPScan confirmed the WordPress version and showed an outdated theme, but I couldn&#8217;t find any public vulnerabilities tied to it. For a moment, I hit a dead end \u2014 but that\u2019s part of the process. I went back to the Nikto output and examined the following paths manually:<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li><code>\/index<\/code>: Infinite refresh loop<\/li>\n\n\n\n<li><code>\/admin\/<\/code>: Same refresh behavior<\/li>\n\n\n\n<li><code>\/readme\/<\/code>: A short message: <em>\u201cI like where your head is at. However I&#8217;m not going to help you.\u201d<\/em><\/li>\n\n\n\n<li><code>\/image\/<\/code>: Linked to a blog post, but nothing useful there&#8230; yet.<\/li>\n<\/ul>\n\n\n\n<p class=\"wp-block-paragraph\">That\u2019s when I thought of checking <code>robots.txt<\/code>.<\/p>\n\n\n\n<figure class=\"wp-block-image size-full\"><img loading=\"lazy\" decoding=\"async\" width=\"208\" height=\"77\" src=\"https:\/\/hackingwithj.com\/wp-content\/uploads\/2025\/04\/Schermafbeelding-2025-04-15-110012.png\" alt=\"\" class=\"wp-image-78\"\/><\/figure>\n\n\n\n<p class=\"wp-block-paragraph\">In normal websites, <code>robots.txt<\/code> is a file placed at the root of a domain to guide <strong>search engine crawlers<\/strong> on what pages to index or ignore. For example, a company might want to hide <code>\/admin<\/code> from being indexed on Google. But in a CTF or pentest, this file can leak sensitive directories or hidden files.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Sure enough, this <code>robots.txt<\/code> contained a wordlist file:<\/p>\n\n\n\n<pre class=\"wp-block-code has-vivid-purple-color has-text-color has-link-color wp-elements-24784bf0fd970c9fb1c7b99d2b98f87c\"><code>$ file fsocity.dic\nfsocity.dic: ASCII text, with very long lines\n\n$ wc fsocity.dic\n858160 fsocity.dic<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">A massive wordlist \u2014 perfect for brute-forcing WordPress login, but it would take a long time. So I kept looking for a shortcut. Another common file in WordPress installs is <code>\/license.txt<\/code>. It typically contains licensing information for the WordPress software \u2014 harmless on real websites. But here, it had a <strong>Base64-encoded string<\/strong> that decoded to:<\/p>\n\n\n\n<pre class=\"wp-block-code has-vivid-purple-color has-text-color has-link-color wp-elements-b30ff05e8c37523f2c250208d37f6ccf\"><code>$ echo &lt;string> | base64 -d\nelliot:ER28-0652<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">Looks like valid credentials! I used these to log into WordPress as <strong>user <code>elliot<\/code><\/strong>, and sure enough, I was in \u2014 with <strong>admin access<\/strong>.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">Gaining Shell Access<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">Once inside, I tried to launch a Meterpreter session using Metasploit:<\/p>\n\n\n\n<pre class=\"wp-block-code has-vivid-purple-color has-text-color has-link-color wp-elements-41e0f5d7a81884e9401c279e73690149\"><code>$ msfconsole\n<span style=\"text-decoration: underline;\">msf6<\/span> > use exploit\/unix\/webapp\/wp_admin_shell_upload\n<span style=\"text-decoration: underline;\">msf6<\/span> exploit(exploit\/unix\/webapp\/wp_admin_shell_upload) > set password ER28-0652\n<span style=\"text-decoration: underline;\">msf6<\/span> exploit(exploit\/unix\/webapp\/wp_admin_shell_upload) > set username elliot\n<span style=\"text-decoration: underline;\">msf6<\/span> exploit(exploit\/unix\/webapp\/wp_admin_shell_upload) > set rhosts 192.168.68.66\n<span style=\"text-decoration: underline;\">msf6<\/span> exploit(exploit\/unix\/webapp\/wp_admin_shell_upload) > run<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">I ran into an error that said WordPress wasn\u2019t detected. Turns out, this is a known issue \u2014 I bypassed it by running:<\/p>\n\n\n\n<pre class=\"wp-block-code has-vivid-purple-color has-text-color has-link-color wp-elements-aefa2f9721c708a0447bce7d811f7ee7\"><code>set wpcheck false<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">Even then, I couldn\u2019t get a shell. So I fell back to the tried-and-true <strong>Pentestmonkey reverse shell<\/strong>. I uploaded it to the <strong>404 template<\/strong> in the WordPress theme editor and triggered it in my browser. Boom \u2014 I had a shell.<\/p>\n\n\n\n<figure class=\"wp-block-image size-full\"><img loading=\"lazy\" decoding=\"async\" width=\"878\" height=\"612\" src=\"https:\/\/hackingwithj.com\/wp-content\/uploads\/2025\/04\/Schermafbeelding-2025-04-15-140057.png\" alt=\"\" class=\"wp-image-83\" srcset=\"https:\/\/hackingwithj.com\/wp-content\/uploads\/2025\/04\/Schermafbeelding-2025-04-15-140057.png 878w, https:\/\/hackingwithj.com\/wp-content\/uploads\/2025\/04\/Schermafbeelding-2025-04-15-140057-300x209.png 300w, https:\/\/hackingwithj.com\/wp-content\/uploads\/2025\/04\/Schermafbeelding-2025-04-15-140057-768x535.png 768w\" sizes=\"auto, (max-width: 878px) 100vw, 878px\" \/><\/figure>\n\n\n\n<p class=\"wp-block-paragraph\">Exploring the system, I found this in <code>\/home\/robot\/<\/code>:<\/p>\n\n\n\n<pre class=\"wp-block-code has-vivid-purple-color has-text-color has-link-color wp-elements-8f6d4f8b37cc7bede5bca29e0425cdd4\"><code>$ ls home\/robot\nkey-2-of-3.txt\npassword.raw-md5<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">The key file was locked, but the hash in <code>password.raw-md5<\/code> was easily cracked using <a class=\"\" href=\"https:\/\/crackstation.net\">Crackstation<\/a>:<\/p>\n\n\n\n<figure class=\"wp-block-image size-full\"><img loading=\"lazy\" decoding=\"async\" width=\"1010\" height=\"74\" src=\"https:\/\/hackingwithj.com\/wp-content\/uploads\/2025\/04\/Schermafbeelding-2025-04-15-141820.png\" alt=\"\" class=\"wp-image-84\" srcset=\"https:\/\/hackingwithj.com\/wp-content\/uploads\/2025\/04\/Schermafbeelding-2025-04-15-141820.png 1010w, https:\/\/hackingwithj.com\/wp-content\/uploads\/2025\/04\/Schermafbeelding-2025-04-15-141820-300x22.png 300w, https:\/\/hackingwithj.com\/wp-content\/uploads\/2025\/04\/Schermafbeelding-2025-04-15-141820-768x56.png 768w\" sizes=\"auto, (max-width: 1010px) 100vw, 1010px\" \/><\/figure>\n\n\n\n<p class=\"wp-block-paragraph\">This gave me the <strong>robot user\u2019s password<\/strong>, and I logged in using: <code>su robot<\/code> To make the shell interactive, I upgraded it with: <code>python -c 'import pty; pty.spawn(\"\/bin\/bash\")'<\/code> Now I could read the second key:<\/p>\n\n\n\n<figure class=\"wp-block-image size-full\"><img loading=\"lazy\" decoding=\"async\" width=\"847\" height=\"373\" src=\"https:\/\/hackingwithj.com\/wp-content\/uploads\/2025\/04\/Schermafbeelding-2025-04-15-143123.png\" alt=\"\" class=\"wp-image-85\" srcset=\"https:\/\/hackingwithj.com\/wp-content\/uploads\/2025\/04\/Schermafbeelding-2025-04-15-143123.png 847w, https:\/\/hackingwithj.com\/wp-content\/uploads\/2025\/04\/Schermafbeelding-2025-04-15-143123-300x132.png 300w, https:\/\/hackingwithj.com\/wp-content\/uploads\/2025\/04\/Schermafbeelding-2025-04-15-143123-768x338.png 768w\" sizes=\"auto, (max-width: 847px) 100vw, 847px\" \/><\/figure>\n\n\n\n<h2 class=\"wp-block-heading\">Privilege Escalation<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">Here\u2019s where I got stuck again. I tried compiling kernel exploits for 3.13.0 (the version revealed by <code>uname -a<\/code>), but I couldn\u2019t write to disk as <code>robot<\/code>. After struggling for a while, I decided to look at a <strong>write-up<\/strong> by someone else who had done the same challenge.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">That\u2019s when I learned about <strong>SUID binaries<\/strong>. SUID (Set User ID) is a Linux permission that allows a user to execute a file with the <strong>permissions of the file owner<\/strong>, not the user running it. If a binary with the SUID bit is owned by <code>root<\/code>, and it\u2019s not properly secured, it can be exploited to <strong>gain root privileges<\/strong>.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">I listed SUID binaries with:<\/p>\n\n\n\n<figure class=\"wp-block-image size-full\"><img loading=\"lazy\" decoding=\"async\" width=\"472\" height=\"699\" src=\"https:\/\/hackingwithj.com\/wp-content\/uploads\/2025\/04\/Schermafbeelding-2025-04-15-151453.png\" alt=\"\" class=\"wp-image-89\" srcset=\"https:\/\/hackingwithj.com\/wp-content\/uploads\/2025\/04\/Schermafbeelding-2025-04-15-151453.png 472w, https:\/\/hackingwithj.com\/wp-content\/uploads\/2025\/04\/Schermafbeelding-2025-04-15-151453-203x300.png 203w\" sizes=\"auto, (max-width: 472px) 100vw, 472px\" \/><\/figure>\n\n\n\n<p class=\"wp-block-paragraph\"> Referrence: <a href=\"https:\/\/blog.g0tmi1k.com\/2011\/08\/basic-linux-privilege-escalation\/\">Basic Linux Privilege Escalation &#8211; g0tmi1k<\/a><\/p>\n\n\n\n<h2 class=\"wp-block-heading\">What did i learn?<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">This challenge helped reinforce several key concepts:<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>Enumeration is everything<\/strong> \u2014 especially manually checking simple files like <code>robots.txt<\/code> and <code>license.txt<\/code>.<\/li>\n\n\n\n<li><strong>Don\u2019t give up if something doesn\u2019t work<\/strong> \u2014 I learned to try different tools and fallback options (like reverse shells).<\/li>\n\n\n\n<li><strong>Privilege escalation techniques<\/strong> \u2014 especially the power and danger of misconfigured <strong>SUID binaries<\/strong>.<\/li>\n\n\n\n<li>It\u2019s okay to check <strong>write-ups<\/strong> when stuck, as long as you <strong>understand the logic<\/strong> and <strong>apply the lesson<\/strong> moving forward.<\/li>\n<\/ul>\n","protected":false},"excerpt":{"rendered":"<p>Capture The Flag (CTF) challenges are one of the best ways to grow as a security enthusiast or aspiring penetration tester. They throw you into real-life scenarios where you have to think creatively, make smart assumptions, and often fail before you succeed. This blog post walks through one such CTF I attempted, covering everything from [&hellip;]<\/p>\n","protected":false},"author":2,"featured_media":0,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"site-container-style":"default","site-container-layout":"default","site-sidebar-layout":"default","disable-article-header":"default","disable-site-header":"default","disable-site-footer":"default","disable-content-area-spacing":"default","footnotes":""},"categories":[8],"tags":[],"class_list":["post-73","post","type-post","status-publish","format-standard","hentry","category-ctf"],"_links":{"self":[{"href":"https:\/\/hackingwithj.com\/index.php?rest_route=\/wp\/v2\/posts\/73","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/hackingwithj.com\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/hackingwithj.com\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/hackingwithj.com\/index.php?rest_route=\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"https:\/\/hackingwithj.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=73"}],"version-history":[{"count":20,"href":"https:\/\/hackingwithj.com\/index.php?rest_route=\/wp\/v2\/posts\/73\/revisions"}],"predecessor-version":[{"id":101,"href":"https:\/\/hackingwithj.com\/index.php?rest_route=\/wp\/v2\/posts\/73\/revisions\/101"}],"wp:attachment":[{"href":"https:\/\/hackingwithj.com\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=73"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/hackingwithj.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=73"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/hackingwithj.com\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=73"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}