Oh, I don't know about Matrix. You get to see[1] Trinity determine a vulnerable SSH is running, using nmap, only to then exploit it to get #.

[1] https://www.youtube.com/watch?v=0PxTAn4g20U