Matrix 1 (Vulnhub) | Walkthrough by ROTP

We're going to start scanning our network to see what ip address has our target.

After get the target's IP address (in this case 192.168.1.13) we're going to use nmap to scan all tcp ports and services of our target.

-sC: is to test every service with the script by default that has nmap.

-sV: is to enumerate services' versions.

-p-: is to indicate nmap to scan all tcp ports.

Note: as you can see we use the target's IP as the last argument.

We had this as result, only 3 open ports and 2 services, let's enumerate the port 80 (if I see an SSH server running I usually scan it at the end).

This is the page we have as result, (I think is a cool page).

The first I think when I have a webpage is to look for the it source code.

The first thing I saw was a PNG file, and as you can see the filename is p0rt_31337.png, this can be a little hint.

This is the image, if we want we can download it.

I went to the page running on port 31337 (also we saw this open port, in the previous nmap scan).

As I told you the first thing what I look for is the source code.

And as a simple HTML comment I found a text that appears to be a Base64 text line.

I tried to decode this base64 text line, with the command below, if you don't understand what I did let me describe you:

with echo I send this text to a file named base64text with the option (>).

And we got as the text echo "Then you'll see, that it is not the spoon that bends, it is only yourself. " > Cypher.matrix as a result, if you analyze the text, at the end you can think about a filename (Cypher.matrix), Why? because in the result the echo command is sending the text to a file named Cypher.matrix. After think about a file, I tried to look for the file with the link below:
http://192.168.1.13:31337/Cypher.matrix, and effectively we got a file named Cypher.matrix.

With the following command we only moved the file downloaded previously to our current working directory.

When I tried to see the content of this file.

And I found that... WTF!, I know, I know, I was thinking like you, WTF is that!. But when you don't know about some piece of code the your best friend in this moment is Google.

With Google I found that this code is BrainFuck, and the first thing I did was to look for a possible decoder or interpreter on the internet, of course we are talking about our friend Google.

And we have many pages to decode this.



I tried with this page, let me give you the link, if you want you can use another webpage.

And we got the following text as a result: You can enter into matrix as guest, with password k1ll0rXX. Note: Actually, I forget last two characters so I have replaced with XX try your luck and find correct string of password. Now we have a user as a hint and a incomplete password.

The next movement will be to create a wordlist with the word k1ll0r plus all the possible  combinations instead of two X. We can do this with the maskprocessor tool, and with the following command where every ?a tells to maskprocessor to output all the possible characters in this place. At the end we send the result to a file named wordlist.

We are going to use hydra to issue a brute force attack against the SSH server with the user guest and the wordlist we generate previously.
-l: Is to specify a single user.
-P: Is to specify the wordlist of passwords.
-f: Is to specify that the brute force attack will stop when it find vaild credentials.
-t: Is to specify the number of threads.

After some minutes we got the SSH credentials.

And we join to the remote system with SSH (You must know how to use SSH).

After some tries to execute commands we noticed the we are in an rbash or a Restricted BASH, basically is a shell with limitations, if we have this scenario, we have to look for our path variable to see where are the binaries tha we can execute, with the command echo $PATH and as we could see our PATH is /home/guest/prog we now can see binaries or scripts in this directory with the command echo /home/guest/prog/* and we only have vi the text editor.

We execute vi to enter to the text editor.

And the first thing we can do to bypass the rbash with vi is to execute another shell with vi  we could do this pressing ESC and then typing :!/bin/bash where the ! symbol means execution.

And after that we are in bash instead of rbash.

But our path is the same, we can copy the path of our local machine to export it to the remote machine, the following images will show you how to do this.

We can copy the PATH of our local machine.

With the command export we specify the variable PATH and put the value that we want, in this case we need to put the PATH of our local machine, after that we issued the wget command to verify that we have a full PATH.

The first thing I do to is verify if I have sudo and verify what could I do with sudo (sudo -l).

As we can see with password we can execute anything as any user in the system (including the root) what means that we can execute de command sudo su and typing the password we got previously (k1ll0r7n)... surprise MTF XD we are root. After that we can go now to the root home directory.

 When we list the content in the root home directory, we can see the flag.txt file.

And if we see the information in the flag.txt (cat flag.txt) file that's the result.

Thank you for read this.