Write-up
Step-by-step guide on the approach taken to pwn the machine.
Objectives
Find the three hidden keys.
Gain initial access to the machine.
Escalate privileges to root.
Reconnaissance
We start by scanning for open ports with Nmap:
nmap -Pn -sCV -F -T5 <ip_victim>The scan reveals:
Port 22 (SSH) - closed.
Port 80 (HTTP) - open.
Port 443 (HTTPS) - open.
Let's focus on port 80 first. Browsing to http://<ip_victim> brings up what looks like a puzzle or game. Time to start digging.
Gaining a Shell
After some exploration, we check for a robots.txt file:
Inside, we find two interesting entries:
A file called
fsocity.dic— a wordlist.The first key!
Given the presence of a wordlist, it hints at potential password brute-forcing. To find a target for brute-forcing, let's enumerate directories with Dirbuster or similar tools.
Quickly, we discover this is a WordPress site (wp-login.php present).
Now, let's try enumerating WordPress users with wpscan:
Surprisingly, no luck.
Observation: When entering random credentials in the login form, it shows different error messages depending on the username — meaning valid usernames can be discovered this way.
By trying names manually (admin, root, mrrobot, fsociety...), entering Elliot triggers a different error.
Thus, we refine our brute-force:
Or using Hydra:
Eventually, we find the password:
Elliot : ER*******
Now authenticated, let's log into the WordPress admin panel!
Navigating to Appearance > Theme Editor, we find 404.php.
Classic move: let's replace it with a reverse shell payload from Pentestmonkey, adapting it with our IP and port.
Start a listener:
Then, trigger the shell by visiting any non-existent page.
Boom — reverse shell obtained!
To upgrade the shell:
Privilege Escalation
Inside the system, searching /home/robot/, we find the second key — but cannot read it yet.
However, a file password.raw-md5 is accessible.
It contains an MD5 hash.
Cracking the hash via CrackStation gives the password.
Switching to user robot:
With this, the second key is retrieved!
Now for root access.
Checking binaries with the SUID bit:
We spot nmap with SUID permissions!
Upon checking its version (nmap --version), it's 3.81 — vulnerable to execution tricks.
Following GTFOBins instructions:
Root shell achieved.
Searching through the filesystem, the third and final key is found.
Mission accomplished!
Result
First key: Found via robots.txt
Second key: Found under /home/robot/ after switching user
Third key: Found after privilege escalation using vulnerable SUID nmap
Last updated