Mr. Robot S2E4 - IRC chat clues

#Mr. Robot

At the end of episode 4 season 2, titled eps2.2init1.asec, Elliot takes the plunge and gets back onto a computer for the first time this season. Elliot SSHs to 192.251.68.240 and connects to irc.eversible.co, using the BitchX client, finally bouncing to irc.colo-solutions.net.

Screenshot from Mr Robot showing the BitchX client

I won’t go much further into what happens in the last parts of the episode, however there are a few easter eggs that you can find. If we curl the IP address that Elliot uses to connect above we get redirected through a few domains until landing on http://irc.colo-solutions.net :

$ curl -vso/dev/null -L 192.251.68.240
* Rebuilt URL to: 192.251.68.240/
* Hostname was NOT found in DNS cache
*   Trying 192.251.68.240...
* Connected to 192.251.68.240 (192.251.68.240) port 80 (#0)
> GET / HTTP/1.1
> User-Agent: curl/7.35.0
> Host: 192.251.68.240
> Accept: */*
>
* HTTP 1.0, assume close after body
< HTTP/1.0 302 Found
< Location: http://i240.bxjyb2jvda.net/
< Server: BigIP
* HTTP/1.0 connection set to keep alive!
< Connection: Keep-Alive
< Content-Length: 0
<
  <snip>
>
* HTTP 1.0, assume close after body
< HTTP/1.0 200 OK
< Server: Apache
< Cache-Control: max-age=60
< Expires: Thu, 04 Aug 2016 12:29:29 GMT
< Content-Type: text/html; charset=UTF-8
< Date: Thu, 04 Aug 2016 12:28:29 GMT
< Content-Length: 4423
< Connection: close
< Set-Cookie: pers_cookie_insert_app.usanetwork=543601368.20480.0000; expires=Thu, 04-Aug-2016 16:28:29 GMT; path=/
<
{ [data not shown]
* Closing connection 2

Firing this up in your browser presents you with a qwebirc instance. With some thanks form the JS in the page we’re logged in as Darlene and join the same channel used in this episode, #th3g3ntl3man.

<script>
var ircChannelName = '#th3g3ntl3man',
    loggedInUserName = 'D0loresH4ze',
    path = '',
    remote = 1,
    maxChars = 140;
</script>

Once in Elliot joins the channel under his alias samsepi0l and asks us the name of the FBI operation mentioned in the episode. Respond with the correct answer, berenstain, and Elliot starts responding with a whole lot of clues for the next episode.

Apart from that, the chat doesn’t really do anything interesting. If you reply with something else Elliot just exits the chat and doesn’t reply with anything else. I’ve posted the whole chat below for reference.

[22:15] == D0loresH4ze [~D0loresH4ze@203.29.143.102] has joined #th3g3ntl3man
[22:15] == samsepi0l [~samsepi0l@192.251.68.240] has joined #th3g3ntl3man
[22:15] <samsepi0l> what was the name of that operation again?  
[22:15] <D0loresH4ze> berenstain
[22:15] <samsepi0l> okay, the FBI standard issue smartphone runs android
[22:15] <samsepi0l> http://imgur.com/a/uAqpN
[22:15] <samsepi0l> we plant a femtocell on the FBI floor at e corp. wifi capable
[22:15] <samsepi0l> every android phone in range will connect to it, then our exploit runs
[22:16] <samsepi0l> from the phones, we’ll be able to get emails– hopefully for the past 30 days, and SMS
[22:16] <samsepi0l> basically anything on local storage
[22:16] <samsepi0l> it will need to be patched into the e corp network too- maybe we find the IDF on that floor.
[22:16] <samsepi0l> then we can poke around on the new network and pull from their new email/file servers
[22:16] <samsepi0l> coding the exploit now
[22:16] <samsepi0l> will come back on when i’m closer to being done
[22:16] == samsepi0l [~samsepi0l@192.251.68.240] has quit [Client Quit]
Screenshot of the Easter egg page containing conversation between the user and Elliot

The page itself isn’t very interesting, all the ‘IRC communication’ is done over AJAX calls to a PHP script called ajax1.php. All it does is respond with a big JSON blob and I can’t really find any other clues around the page. Let me know if you find anything!