WEBVTT 00:00:00.100 --> 00:00:01.430 [Autogenerated] in this demonstration, 00:00:01.630 --> 00:00:04.300 we're going to get started with Lynn Pease. 00:00:04.310 --> 00:00:07.430 The miter tactic that we're going to be looking at relates to 00:00:07.430 --> 00:00:10.920 privilege escalation by abusing the set you I. 00:00:10.920 --> 00:00:11.440 D. 00:00:11.600 --> 00:00:13.120 And set group ID. 00:00:13.330 --> 00:00:18.920 But generally on Linux and mac Os when these bits are set for any application, 00:00:19.420 --> 00:00:25.100 that specific application will run with the privileges of the owning user. 00:00:25.640 --> 00:00:30.680 So what we are aiming for is to discover any type of applications that have 00:00:30.680 --> 00:00:35.520 those bits set that could have been set by a root user. 00:00:35.680 --> 00:00:39.500 Now of course you could use the find command to search for such files. 00:00:39.860 --> 00:00:43.710 However Lynn Pease will be able to do it for us along 00:00:43.710 --> 00:00:46.560 with a lot of other additional checks. 00:00:46.890 --> 00:00:51.610 So let's go ahead and confirm that my current logging user is not a member of 00:00:51.610 --> 00:00:55.470 the pseudo was group and does not have root permissions. 00:00:56.330 --> 00:00:59.030 The first thing that I'm going to do to double check this is I'm gonna go 00:00:59.030 --> 00:01:02.990 ahead and try to edit the password file as you know, 00:01:02.990 --> 00:01:06.420 the specific file will contain a wealth of information so as I 00:01:06.420 --> 00:01:10.280 try to access that file we can see that I am denied and I 00:01:10.280 --> 00:01:12.380 definitely am not part of the group. 00:01:13.110 --> 00:01:15.330 So let's go ahead and run len P. 00:01:15.330 --> 00:01:15.620 S. 00:01:15.810 --> 00:01:17.770 The first thing that I'm gonna do is take a look at 00:01:17.770 --> 00:01:20.600 the options that exist right away. 00:01:20.600 --> 00:01:22.900 I can see that I've got a number of different options 00:01:22.900 --> 00:01:25.230 that I can use with Lynn Pease. 00:01:25.540 --> 00:01:27.890 I can define a specific check, 00:01:27.980 --> 00:01:31.620 I can perform network reconnaissance and a lot more. 00:01:31.640 --> 00:01:35.030 But what I'm gonna do is go ahead and run Lynn Pease 00:01:35.040 --> 00:01:37.290 with all the checks and to do this. 00:01:37.300 --> 00:01:41.610 All I'm gonna do is execute Lynn Pease right away. 00:01:41.610 --> 00:01:46.820 We see the awesome logo along with the color scheme and the legend. 00:01:46.970 --> 00:01:49.640 Let's give this a minute for it to run so that we can 00:01:49.640 --> 00:01:51.130 then take a look at the results. 00:01:51.280 --> 00:01:55.570 Now that Lynn Pease has completed, let's work through some of the results. 00:01:55.580 --> 00:01:56.170 However, 00:01:56.170 --> 00:01:58.950 please note that there is a lot of information that Lynn 00:01:58.950 --> 00:02:03.090 Pease has brought back to me to work through everything would 00:02:03.090 --> 00:02:04.560 take a lot of time on the video. 00:02:04.890 --> 00:02:08.590 So what I would really suggest is that you actually spend some time working 00:02:08.590 --> 00:02:12.460 through all of the different outputs in your own lab environment to really 00:02:12.460 --> 00:02:15.750 get an understanding of what Lynn Pease provides. 00:02:15.790 --> 00:02:17.310 So as I start from the beginning, 00:02:17.320 --> 00:02:21.180 the first thing that we have is of course the awesome logo and the color scheme. 00:02:21.860 --> 00:02:24.240 We then have some basic information about the current 00:02:24.240 --> 00:02:27.760 lockdown user along with the system information. 00:02:29.760 --> 00:02:32.660 Now the component that we are specifically looking for 00:02:32.670 --> 00:02:34.590 is the interesting files component. 00:02:34.980 --> 00:02:37.110 So as I work through the rest of the results, 00:02:37.470 --> 00:02:39.920 I'm gonna pause at some of the interesting sections. 00:02:40.060 --> 00:02:40.860 For example, 00:02:40.960 --> 00:02:44.530 this one that relates to the exploit suggested this is a good way 00:02:44.530 --> 00:02:48.530 for you to discover any type of potential exploits that could work 00:02:48.540 --> 00:02:50.710 on this current operating system. 00:02:50.720 --> 00:02:53.530 We don't have information about any processes that might have 00:02:53.530 --> 00:02:57.550 credentials stored in memory and any type of Cron jobs that we 00:02:57.550 --> 00:03:01.590 could leverage as we come towards the users section we can see the 00:03:01.590 --> 00:03:05.680 super users along with the rest of the additional users and groups 00:03:05.680 --> 00:03:07.390 that exist on the system. 00:03:07.440 --> 00:03:09.750 And now we come to the interesting files. 00:03:10.310 --> 00:03:14.620 The first check that Lynn piece executes is looking for any type of 00:03:14.630 --> 00:03:18.700 binaries that have the seward permission right away. 00:03:18.700 --> 00:03:22.980 We see two that are standing out and those are highlighted in yellow. 00:03:23.540 --> 00:03:29.510 That is the find and the copy commands working through the rest of the output. 00:03:29.510 --> 00:03:31.360 We can see some of them are pretty standard. 00:03:32.010 --> 00:03:34.680 And then as we scroll down we can see any type of binaries 00:03:34.680 --> 00:03:37.380 that have the set group by the bits enabled. 00:03:37.440 --> 00:03:39.730 But as I scroll back to the top we're going to focus 00:03:39.730 --> 00:03:42.900 on the find and the copy binaries. 00:03:43.360 --> 00:03:45.600 So I'm gonna go ahead and open up a new tab. 00:03:45.610 --> 00:03:48.990 And the first binary that we're gonna test is defined binary. 00:03:49.040 --> 00:03:52.520 So in order to test the find binary and see if we have any type 00:03:52.520 --> 00:03:55.680 of root permissions that the binary is using. 00:03:55.850 --> 00:03:58.580 I'm gonna go ahead and just create a standard file. 00:03:58.640 --> 00:04:01.130 Next I'm going to perform a simple find command. 00:04:01.140 --> 00:04:01.710 However, 00:04:01.720 --> 00:04:05.030 I'm going to add the execution command with a 00:04:05.040 --> 00:04:07.520 command that I would like to execute, for example, 00:04:07.530 --> 00:04:10.080 just using who am I As I eat, enter, 00:04:10.280 --> 00:04:14.040 I can now see that that specific binary is in fact 00:04:14.110 --> 00:04:16.620 executing with root permissions. 00:04:16.740 --> 00:04:19.700 The next that I'm going to focus on is the copy binary. 00:04:19.790 --> 00:04:24.570 So right now I'm gonna go ahead and make a copy of the password 00:04:24.750 --> 00:04:27.250 file that currently exists on the system. 00:04:27.270 --> 00:04:29.510 So the next thing that I'm gonna do is actually go 00:04:29.510 --> 00:04:31.560 ahead and try to edit the file. 00:04:31.580 --> 00:04:34.270 Now as I look at the file I can see the contents of the file. 00:04:34.280 --> 00:04:38.660 However I can't really edit it in this current user context. 00:04:39.180 --> 00:04:43.130 But since I could make a copy of the file I can now go ahead 00:04:43.200 --> 00:04:46.010 and edit this file on my Kali Linux machine. 00:04:46.630 --> 00:04:49.180 So essentially what you could do is take the file and 00:04:49.180 --> 00:04:52.040 create a new user altogether assigning it. 00:04:52.050 --> 00:04:53.290 Root permissions. 00:04:53.900 --> 00:04:56.800 Now I've already done that in my Kali Linux machine. 00:04:56.920 --> 00:04:59.810 And of course to get the file from this current target 00:04:59.810 --> 00:05:02.280 machine to your Kali Linux machine you have a range of 00:05:02.280 --> 00:05:03.870 different options that you could use. 00:05:03.950 --> 00:05:06.580 So let's take a look at the file that I have already modified. 00:05:06.680 --> 00:05:11.390 You'll notice at the bottom of the file I have added a new user account 00:05:11.400 --> 00:05:14.980 called proof with a password that I have created. 00:05:15.570 --> 00:05:19.840 So now let's use the copy command to actually go and replace the existing 00:05:19.840 --> 00:05:22.620 password file with the one that I have just modified. 00:05:22.720 --> 00:05:26.190 So right away I see I do not have any error which means it worked. 00:05:26.580 --> 00:05:28.340 So let's go ahead and verify this. 00:05:28.350 --> 00:05:32.830 If I look at the file, I can see that my privileged account does exist. 00:05:32.970 --> 00:05:38.070 So now as I go ahead and change my user, I now have root permissions. 00:05:38.390 --> 00:05:41.550 So this is a quick and easy way that I could discover a 00:05:41.550 --> 00:05:45.320 binary on the Stargate machine that has a misconfigurations 00:05:45.330 --> 00:05:47.020 in the form of too much permissions, 00:05:47.240 --> 00:05:51.690 allowing me to leverage that to go and create a new user on the target machine, 00:05:51.700 --> 00:05:55.820 which allowed me to escalate as that new root user.