本文介绍了在VulnHub上进行的一次入门级安全挑战，涉及环境搭建、信息收集、Alice账户查询及权限提升。通过端口扫描发现靶机开放了22和80端口，通过Web源码解析获取Alice账户信息，成功注册并登录后找到flag1。尝试提权过程中，发现Alice用户可通过执行命令无需密码，利用此漏洞获取flag2。
01 环境搭建
- 靶机环境下载：https://www.vulnhub.com/entry/me-and-my-girlfriend-1,409/
- 题目信息如下，难度入门级，需要获取俩个flag
Description: This VM tells us that there are a couple of lovers namely Alice and Bob, where the couple was originally very romantic, but since Alice worked at a private company, "Ceban Corp", something has changed from Alice's attitude towards Bob like something is "hidden", And Bob asks for your help to get what Alice is hiding and get full access to the company!
Difficulty Level: Beginner
Notes: there are 2 flag files
Learning: Web Application | Simple Privilege Escalation
02 信息收集
将靶机环境恢复到virtualbox之后，开始第一步信息收集工作。
发现靶机
查看攻击机Kali的ip为192.168.56.1(环境恢复时采用Host-Only Adapter)
使用nmap扫描网段内的ip地址</
最低0.47元/天 解锁文章
扫一扫
1440
被折叠的 条评论
为什么被折叠?
到【灌水乐园】发言
