提示说:
Theflag07user was writing their very first perl program that allowed them to ping hosts to see if they were reachable from the web server.
这是一个cgi程序,运行着一个server服务,查看源代码:
查看源码发现漏洞处在`ping -c 3 $host`这句,host为攻击者可控,通过| ;等符号执行额外命令
首先查看运行这个程序权限是什么,以level07账号登录进去查看目录权限:
可知道这个程序的运行者是flag07,直接利用/bin/getflag提权,或者自己创建一个shell提权