Hi, within this section, we're going to continue with Wahhab and we're going to sell Mr. Robot CTF.
So if you have heard about this, I believe you know that this is a TV series.
OK, so, Mr. Robot, if you search for it, you will see that this is actually a TV series and apparently
about to Hekker and people really love it.
I hadn't had the opportunity to watch it yet, but I will in some future, I believe.
And if you have watched it, maybe it will be easier for you to solve this challenge, because there
may be there might be some tips.
I don't know.
So I'm just going to go in and try and hack this box.
OK, so over here we are in the wrong number one more time.
We're going to use this a lot during this course because it's free and they have awesome seats.
They have awesome vulnerable machines over here.
So in this case, as you can see, Mr. About one is released in 2016 and you can still find your ways
over here.
So make sure you download one of these areas and make sure you read the description as well.
And as you can see, this has three keys hidden in different locations again.
So we're going to capture three Fleck's.
So it says that each keys progressively difficult to find, which is good.
And it says that the virtual machine isn't too difficult, but maybe it's a beginner.
Maybe it's like an intermediate kind of level of thinking.
So we don't have anything else over here.
So make sure you download it.
Of course, I downloaded it for you in order not to make you wait.
So I'm just going to double click on this OIA and just install it on my virtual box.
So let me just do that double click over here and just live with it.
Live this as it is.
We can change it later on.
Just import this, OK, and make sure you wait until it's important.
So far so good.
Let me come over here and just open the settings.
As you can see, this is Ubuntu 64 bit, OK?
And I'm going to come over here.
Maybe I can just make it like one gig or something like that, but we're not going to use it anyway.
So you're free to use it with 500 megs as well.
OK, so I'm going to come over here and I'm not going to change anything regarding to display storage
or audio.
Of course I'm going to change the network.
I'm going to bring it into that network and just make sure that I love the promiscuous mode over here.
Make sure your colors and your Mr. Robot is on the same network.
OK, so if you're using another way to do that, it's perfectly fine.
I'm using that network, so make sure you put it on the same network.
So I'm going to open the Mr. Robot over here as well.
OK, and here you go.
Of course, we're not going to do much with inside of Mr. Robot.
We have more.
We're here.
I'm just going to see if we have the IP address.
And as you can see, we don't have any IP address over here.
It just says Mr. Robot, and that's it.
OK, so I'm going to go back to my colleague and let me close this down and just give some credentials
over here.
Of course, we're going to start by finding the IP address of the target machine.
So let me open my terminal.
I'm going to change my keyboard.
First of obviously, you don't have to do that.
I'm going to run on that map, scan against Channel two zero, slash twenty four over here in order
to just see my target IP.
Of course you can do that with net discovery as well.
Just make sure that you run it against your own IP address, our own IP range to be exact, and wait
until you get this response.
So here you go.
We have the scan over here, a map scans completed.
So I did that against tunnel to zero.
If you have another IP range, just go for that.
So over here we have Tunnel 215, which is our target machine, apparently.
And as you can see, we already see some open ports over there, like twenty to eighty four for three.
So we definitely have some kind of web server going on and we have one SNH port closed.
Great.
So we know that this is going to be a penetration test from beginning because we already have seen as
a result and we only have the.
And EPA service running over here.
Of course, I'm going to make it more intense for IMAP against only this target over here, but again,
we know that there is a Web server.
If you want, you can open them up and do this with the map anytime you want.
I'm not going to do that.
I'm just going to do it with a map and just take the notes into my folder, as usual.
So I'm going to go for tea for a which is our intention with verbals on, OK, and I'm going to just
go for the tunnel 215 over here.
And of course, I forgot to put a dash over there inside of Weebles parameter.
And as you can see, it already started.
OK, so we're going to get back some results from the map.
We we actually see the four, four, three and the 80 port open right now.
So it's already discovered that maybe we have some other ports.
Maybe we can do this for all ports.
OK, Dash, B dash or for some UDP ports or TCP ports.
But again, this is good.
So here you go.
DSH is closed.
We only have 80 open and we have some kind of information regarding to https as well.
So we definitely know that this is going to be a Linux machine.
Great.
So this is a Linux machine and I don't know yet if we have some kind of old kernel over here or like
a kernel exploit in the Linux going up.
So what I'm going to do, I'm going to go into my documents folder.
OK, so I'm going to write code document CTF.
So I'm going to create a new directory over here called Mr. Robot and I'm going to create new not text
file over there like we used to do in the previous sections.
So I'm going to neno into that know not start to see, OK, and I'm going to copy everything that we
see over here just to save a Redmap results.
So I'm going to copy this and open the text and pasted over there and he'd control all and control X
in order to save this and quit.
OK, like that.
Right now I'm going to clear this up because we can reach it anytime we want.
And to be honest, we don't have so much going on in in the skin as well.
So basically, I'm going to go for 10 or to 15 over here to see what's there in the website.
So here you go.
We have something going on in the website.
I believe this is some kind of animation going on over there.
But even though it's a CTF and even though it's an animation, I believe this is a quality work.
Right.
So we are getting this we are getting this user experience and better yet, we are presented with some
kind of terminal over here.
So let me zoom in a little bit.
Maybe we can just scan here.
Let me quickly read what's written over there.
Since this is a TV series, I believe we're going to have to deal with this kind of information very
much during this penetration test.
But again, it's a good user experience, so I don't have a problem with that.
I'm just going to see the page source over there.
It says you are not alone.
Great.
So this is kind of HTML, but we have one JavaScript over here and we have some kind of comment about
things.
Let me try this terminal first to see if that works or not.
If I write prepay, for example.
Here you go.
We are presented with kind of maybe give maybe kind of video over there.
And it's not Lagi at all.
It's very good, I believe.
So we are f society and there are some kind of things going on.
I bet these are related with the TV series itself.
We don't understand is that at least I don't understand this, but maybe there is some sort of a tip
in order to solve this challenge.
So I'm just scanning over here.
OK, so here you go.
We are presented with the terminal one more time.
If I just write help as instructed, I can see the other comments like F Society.
So let me just run after society and see what is F society.
It's a.
Are you ready to join the society?
I don't know.
Let me just.
Right.
Help and let me write the Inform.
Here you go.
You're presented with some kind of carrousel over here, like we can swipe the images.
And I don't even read these descriptions.
Maybe they are very important to solve the CTF.
I'm just going to go with the flow right now.
And if we cannot solve it, I can come back and just read them later on.
OK, so I'm being lazy about this, so I'm going the right question.
And here you go.
There are some kind of political things going on over there.
OK, let me just close this down and let me run help one more time.
So we have wake up and see what is wake up and here you go again.
Wake up runs a video for us.
And it seems like the previous video that we have seen in the beginning, these are the same guys I
believe this is supposed to be Wall Street.
I don't know.
Let me see.
Yeah, here you go.
We didn't see much.
And finally, we have the join in fire.
I joined over here.
So it says that, yeah, you don't know me.
I've been watching you.
I've been fighting for you.
Great.
And if you're ready to join me into your email address, OK, so of course, I'm not going to give my
actual email address, but I'm just going to give some kind of fake one over here.
It says that we will be in touch.
OK, maybe we should have given our actual email address.
Maybe it will just send us some tip.
But I don't know about that.
And as you can see, we cannot find very much over here.
Right.
So even though we can come over here, we can see the things going on.
It's very cool.
You're presented with like a terminal in the website itself.
It's very cool.
But we didn't get a tip.
So what I'm going to do, I'm going to use door buster or derp.
So if you don't know about this, this is a this is a tool in order for you to discover hidden pages
like it has a dictionary or you supply a dictionary to it and it tries every page you supply one by
one like you did.
It checks to see if it has an admin page.
It checks as it has a login page, something like that.
OK, so in order to do that first, we're going to have to give the URL, which is HTTP tunnel to 50.
And over here we're going to have to choose the number of threads.
So if we lower this number, like if we choose ten threads, it will be slower if we choose to trad's,
for example, if we say go faster, it will be much faster, but it will consume much more CPU power.
OK, so for the scanning type, I'm going to do a list based brute force and we're going to supply a
list.
So of course we can create our own list for that.
But I'm just going to show you some list that comes prebuilt with callisthenics.
So go to your route like this and find the U.S. Are the user OK or not?
Vare I believe it's supposed to be in user.
Yep.
Let me just go back from here by clicking on this.
So let me find the user.
Ah, here you go.
And user share and there should be a word lists folder over here.
Here you go.
Now this is the thing that we are looking for.
If you come into this world, this folder, you can see there are a couple of words over here, like
for dear Buster, for Derb and for other things as well.
So since we are using door buster, I'm just going to go for the door buster.
And basically you want to use this medium texte wordlist for RCTs or you can use a small one, but a
small one is really small.
It doesn't have that kind of very much extensive work that's going on over there.
So I'm going to go with the medium.
And if you have like a basic CTF, I've heard this that you always use, just use it when you just start
this again.
It will just try to find the solution for you will just try to find the results to you, OK?
And as you can see, current number of running threads is 200.
So make sure you do this as well, not to run this on ten.
And you can see the results over there.
So over here we see the index and every other thing as well.
So if we filter this for response or if we just ordered this by response, then we can get much better
view because.
200 means it's OK.
OK, 200 means it's OK, and for all, four, as you might know, means there is no such thing.
Like if we get a 500, it can be a server error.
So we're going to basically look for two hundreds.
And here we go.
We have some lead.
As you can see, we have WP log in, WP admin, so we have admin as well.
So these are indicators that this website has WordPress installed.
OK, we have images folder over here.
So even though it uses WordPress or not, I don't know about WordPress is installed and it's live so
we can try to see if there is any vulnerability regarding to WordPress.
Right.
And there are a couple of folders over here that we can check as well in order to see what's going on.
So we it is disked isn't complete yet, but we got what we need, I believe.
So I'm going to run the Nito here as well.
So NICTA is a tool to understand the vulnerabilities inside of a Web server or Web website.
We generally use it for RCTs, not for actual pantsing, really, but it's very efficient in CAFS.
So make sure you run this NICTA H and your URL.
You're also H for host.
OK, so here you go.
It started to find things over here as well.
So we're trying to get our lead right.
So we don't know what's going to happen yet, even though it has WordPress.
This is a good lead, but maybe there is nothing wrong with the WordPress.
There is no vulnerability at all.
Then it would be it wouldn't be just our way in.
But of course, we're going to just look for that.
So as you can see, time to finish is displayed like seven days over here.
So this is going to take some time.
But again, I believe we got what we need from the door buster, so we don't have to wait for seven
days.
You can just wait for a couple of minutes more and then stop it.
We're going to continue solving this within the next lecture.