TryHackMe Mr. Robot CTF Writeup: Step-by-Step Guide to Capture All Flags.

Ultimate TryHackMe Mr. Robot CTF Walkthrough: Step-by-Step Guide to Capture All Flags.

 

 

PROBLEMS :-

  1. Find the key-1.txt

  2. Find the key-2.txt

  3. Find the key-3.txt

SOLUTIONS :-

STEP 1 :-   First Scan The IP by Nmap.

 

STEP 2 :-  Looking at the nmap scan, ssh 22 is closed, but 80 and

  443 is open. If the site is open on port 80 it means the website is 

 running. Let's check this website.

STEP 3 :-  Firstly " view the source code "  of this page .

But , nothing to find special .

STEP 4 :-  Let's try dict.  fuzzing.

 After fuzzing , I find the two dict. This is very interesting [/wp-

 login] [/license] 

 Let's go the [/robots.txt]

Download the key-1-0f3.txt , this the flag1.

                              We Slove the first problem.

STEP 5 :-  Let's go to the [/license] url webpage. And view the 

  source code.

See, I find the base64 code. Let's decode the code.

Maybe, this the credential of [wp]. 

STEP 6 :- Let's go to the [/wp-login] url page.

Use the credential, access the admin panel of [wp].

  Now , think if you access the panel, what will you do? I will try 

  input a php-reverseshell  to access the server. Let's gooo... find the 

  any [.php] to edit the code , and input your malicious php code.

  I find the [404.php] seems to be a editable. So, I inject the 

  malicious php code here.

 

STEP 7 :- Set the listener using [netcat] , and refresh or access 

  the page [404.php] , for the reverse-connection.

Go to the page....

 Don't worry for the error , check your nc session.

                      

  Look! I access the shell. Go the user of robot . See the key2 is here. 

  let's cat the key2 , but permission denied. so, try another way.

STEP 8 :- Check the id of shell. In step7 , I see the id is 

  [daemon]. so , change the id 'robot' that's why need to password of 

  robot. In step7-pic, we can see the [password.raw-md5]. Cat the 

  raw-md5 file and crack the password , I think this the password of 

  'robot'.

Crack the password or md5 using crackstation .

STEP 9 :- Using the password switch the 'robot' user , get the 

  flag of 2.

       WOW....

         

      

      We Find The Second Flag and Slove The Second Problem

STEP 10 :- In this part , I will try to root access of the machine. 

  And find the final flag. So, let's goooo...  

  Firstly, check where the key3.txt flag, maybe in the /root dict. 

  And also  find the [SUID]  , what is suid? go to suid , apply this 

  cmd  to the terminal [find / -perm -u=s -type f  2>/dev/null]

  See , i found the nmap . I am using nmap  interactive  shell to 

  gain root access.

Using those cmd , to gain root access.

                      Holax,  We've gained the root access. 

Lets cat the final flag of this challenge .

THANK YOU EVERYONE.

 Read More CTF Write Up....

Read Blog....