Hi.
Now we completed our gaining access.
OK, so we're one step ahead and now we're going to see who we are and what we can do and what we can
do to actually leverage our privileged escalation techniques or escalate our privilege in a way so that
we can be rude in this CTF.
Now, as you can see, I'm in the server, but I cannot even type unless and it says that unless is
not defined.
So it's not good.
Let me try.
Who am I?
And here you go.
I cannot even run.
Where am I?
Which is not good at all.
So we don't have a shell over here.
OK, we are in the system somehow, but we don't have a shell.
We cannot actually run any comments like any Linux comments actually in order to see who we are or what
we can do.
Let me try to define my name, OK, and let me try to print my name.
Here you go.
It works.
I believe this is kind of a python shell.
And as you can see it say so over here, it's a python show.
It's Python two point seven point nine.
So we are in a situation that we can run Python commands in the server that we hacked, but it's not
a shell again.
Now, if you know how to create shells with Python, it's very good.
If you don't know, I'm going to show you how it's done.
So I have a file.
Let me find it.
I use it like taking a note, like for the most generally used, most commonly used comments in my seats.
OK, so I suggest you do the same thing as well.
So let me find it and you will see what I mean.
I'm going to find it over here.
Yeah.
Here you go.
It's it's called CTF Challenge.
And these are the common comments that I used during RCTs.
As you can see, there are a lot of things over here and there is a way to spawn the shell through Python.
So in order to do that, we're going to use Python C, import Y, which is a library.
OK, so Python Library.
And over here we're going to call the Y and say Spon bin Bash or spon bin S.H. So whether we get as
a shell or by Shell, it will be great for us.
So of course I'm going to go with the bash first and if it doesn't work, I'm going to go with the same
shell.
So let me come over here.
Since we are still in Python, we can just write this like that, OK, in Part II and we divide that
spam and bin bash.
All you have to do is just write this.
OK, so here you go.
Now we have the shell.
We exited out of this one and I can clear it and I can run.
Who am I?
Here you are.
So I Mamadu.
And for the ID, I belong to my own group.
I believe it doesn't seem like I have the administrative privileges like route privileges over here.
But of course we're going to try, say, to run unless you can see we get the first flag.
So I'm going to get this out.
And here you go.
I'm not even going to bother with submitting this flag to anywhere, but I'm just going to make note
of it.
OK, this is we're keeping notes.
So let me just go back here to scaffolder Omura Khandi have the that TNT and over here I'm just going
to paste isn't and I'm not going to submit this to anywhere, but maybe later on I will need it for
some reason for proceeding in our ICTV, so I'm just taking it not over here.
So we got the first flag but we have two more to go.
If you remember the description of the CTF, where you going to have to find the second flag and we're
going to have to find the root flag as well.
So far, so good.
Now, let me check if we can find the flag to over here.
So I'm going to call locate flag to that texte.
And here you go.
It's under home dev ops slash flag to that texte.
So maybe we can read this.
Maybe we can go over here.
Let me just say the home develops and over here, let's try to get the flag to the taxi.
And here you go.
Just as expected, it says that permission denied.
Even though we know it's over here, we cannot read it because it belongs to some other user called
developer.
OK, so actually Dev Ops, but the group of the developer is the developer.
So over here we don't.
Have that permission to read, it only develops user can read it as well.
OK, so let me see what we can do over here.
So what we can do actually try to escalate our privilege into the developes user rights.
So we're going to try and go to that user.
So I'm going to just say that's password and see what kind of users we have over here.
So, of course, we have used root, we have the Mamadu, we have the developes and we're going to try
and beat the devil in this case.
So what I'm going to do over here is that you should do for, I believe, every penetration test or
every CTF that you're going to come across.
And we're going to talk about this a lot during the privilege escalation section of this course as well.
Not and in fact, we're going to see a lot of different techniques in order to escalate our privileges
in order to become rude.
And this is actually one of them.
And it's a very valid one.
And it actually is valid in the real life examples as well.
So what I'm going to do, I'm going to try and see if we can find a file that we can just run and execute
that belongs to the dev ops, but we can run it from the user, Mamadu, as well.
Maybe that file will give us some kind of leverage in order to change our user.
OK, maybe it will.
Maybe it won't, but it's worth a shot.
And by the way, there are a lot of tools that we can use for privilege escalation like Lynn Inam or
Lin S.H. So we're going to see some of those in the following sections.
But it's always a good idea to look for these manually so you can run the you name a, for example,
and see what kind of kernel that you're in.
And you can see if you have any kind of kernel exploits in order to escalate your privilege.
We're going to take a look of those and we're going to take so much more steps in order to learn about
privilege, escalation.
Right now, I'm just going to show you one, OK?
And if it doesn't work, of course, we're going to go and see other ones as well.
We're going to see what kind of steps should we take in order to escalate our privileges in a given
Linux environment right now.
Let me show you what I mean.
We're going to use, find and you know how to use find because we have learned it in the previous section.
Right.
So we use this command in order to find some files and folders that belongs to some kind of user or
that belongs to some kind of group or that is inside some kind of size.
So I'm going to just run find that or slash said Badrinath Slash, because we're just running for the
whole server.
We have seen that, remember?
And I'm going to search for user dev ops.
So I'm not user dev ops right now.
I'm user Mamadu, but it's a good idea to run it.
And as you can see, Linux gives us the files and also the permissions that we need or that we have
in order to run or see or just write to that file.
So over here, as you can see, there are a lot of files over there, but these are all permissions
denied, so we cannot do anything with them.
Maybe we can use it for information gathering purposes, but we cannot see them.
We cannot write them or we cannot execute them.
So I'm going to try and find something that we can actually run or see or execute.
And over here we see the flag to texte.
It doesn't say permission denied, but we have seen it right.
We cannot see that.
So over here, we have some other file called Antivirus Stop by and under its Arvi folder over here.
So it's Vertica to look at that, if we can see it or if we can write it or if we can execute it.
It's a little bit suspicious to seek some kind of antivirus python file that is going on over there.
Right.
So we better take a look at that.
And also, we have these TMP folder called Test or Tempy file.
I don't know what it is yet.
Test and we're going to take a look of those.
So I'm going to copy this file because I will try to see the content of it and I will try to see what
we can do with it.
So what I'm going to do, I'm going to copy this file and also bear in mind that we have this.
Test fail as well.
So maybe we can take a look at that and see what we can do with it.
And if you do find something like that in a real life testing scenario, of course, take a look at
those as well.
If you can find anything that you can run or see or write as another user, it's better to take a look
at those.
So I'm going to come over here and see if we have something like test over here.
Yeah, we have tests, but it only say says test.
So I believe there is nothing interesting over here.
Maybe we can check this out.
And here you go for the SRB folder for the antivirus.
That's why we have this script.
So it's open.
Tempy Test editor writes it, it opens it to write it and it writes test.
So it's kind of connected, right.
So when this antivirus that Peevey is executed, then we will see this test folder or test file appearing.
And it's it seems that it's already been executed for us, maybe user that was already executed this
before, or maybe this is kind of a crohn job.
So I'm going to go into the ground and just run Al-Saleh and see what kind of things that we have over
here.
We have the place holder and I believe, which it's nothing.
But if we go for the Annacone and if we cut the electron, then we can see it's kind of a crown job.
And over here it actually runs something.
OK, let me see what it runs.
So I'm going to get the B here as well.
So.
Yep.
So this is for every 30 minutes.
It's for cleaning the section, I believe.
And I don't think this is related with the antivirus.
That's p why.
Let me just get the placeholder here as well.
So this is just a placeholder.
So again, I don't know if we have this over here.
We we can see how we can take a look at that later on.
But again, we know that this antivirus that P.
Y has been executed.
So what I'm trying to do over here is actually we can run this file.
We can run this.
Let me see this antivirus, that profile as another user.
And we don't know actually if we can execute this, but we can try to see it.
We can try to write it and change it.
So maybe we can manipulate this and run it as develops and get the system back from the Web, says,
well, let's stop urine test all of this within the next lecture and see if that works or not.