Hi, within this lecture, we're going to try and change our user to Davos if we can.
We are currently in the Mamadu and we found out that we have to change our user to Davos.
And most probably we're going to make our way up to the roof later on from Davos.
Right.
So right now, we've found something called antivirus Stoppie.
And we know that this belongs to the user and we know that we have access to it somehow.
We don't know yet if we can actually change it or executed, but we going to try and see.
So what can we do with a python file?
It's easy, right?
We can write a reverse shell for Python and get the solution back as DeVillers.
So what I'm going to do, I'm just going to go to Google, OK, and search for Python Reverso.
So if you got the complete data collecting course from me, you know that we can actually write one
ourselves.
But let's be simple and I'm just going to go over here and write Python Reverse Shall code.
And as you can see, there are a lot of over here.
I'm just going to call a cheat sheet.
And yet here you go.
Every time I do that, I come across with Pentax Monkey and it always works.
If you just see something like that, say see details and ignore the risk.
So I'm going to go into the panties, monkey dot that.
As you can see, there are a lot of reverse over here for different kind of programming languages like
Basche, Perl, Python, B, Rubenesque.
And so we're going to use this website a lot during the course.
So as you can see, so this is Python two point seven, and we know that our server runs Python two
point seven.
This is how we get our scale in the first place.
Right.
So I'm going to take this and I'm just going to go under the CD.
Salvy So let me run Ellerslie and here you go.
We see the antivirus that provides a hidden file.
I'm going to try and NENO into this antivirus.
Previte and see if that works.
Here you go.
It works.
So I'm going to paste the thing that we have copied from the Pentagon monkey.
And over here, it's actually a one liner.
So it's actually scripted in a way that you run this in terminal.
But we're not going to run this in terminal.
We're just going to run this as a python code itself.
Right.
So I'm just going to delete everything over here and I'm just going to delete the quotation marks and
I'm just going to delete the test over here as well.
Right.
So if you know Python, you know exactly what I'm doing over here.
I'm just trying to convert this into Python code, so I'm just going to import the socket.
So this is a library.
In order to make the connection, I'm going to import to subprocess and import the OS over here.
So subprocess is for running the system comments and also for a running operating system functionalities
over here.
So I'm going to delete these semicolons because we don't need them anymore.
OK, we were running a python code.
We don't need semicolons in Python.
So over here I'm just going to delete those and just align everything over there.
So if you know Python, this is very easy for you.
If you don't know it, just try to bear with me and just try to make your code look exactly like mine.
So over here, as you can see, we have the IP address and the port address that we want to send this
connection to.
So in this case, I'm just going to change it to our own if config results.
So I'm going to run I have config over here and see it stannow to four in my color Linux.
So I'm going to make this tunnel too far.
OK, and port is not very important.
You can leave it as one, two, three, four.
Just say control or enter and control, exit to exit out of this one.
And let me check this over here.
I'm going to come over here and say Nat Cat and we're going to listen for connections coming from port.
One, two, three, four.
You're going to have to say in Volpi for that.
So we have learned about this stuff during the completed collision course.
I hope you got it or I hope you know what I'm doing right now.
So we're here in the antivirus Stoppie, as you can see, saved.
So it's good.
So we have to find a way, you know, to execute this.
So I'm going to run that slash or python, that antivirus stoppie and see if it works or not.
So as you can see, I managed to run this and here you go.
Now, I have a connection from the server, so I'm going to go to ID and yep, seems like we are Mamadu,
it's weird.
As you can see, we're trying to execute this as the dev ops.
But since we are user, Mamadu, maybe it's not being executed as dev ops.
So it's kind of weird.
So I'm going to control Sead of that one, OK?
It clearly doesn't work and I'm just going to say it again.
Nope, it doesn't work.
So what I'm going to do here, I'm going to try and go to seed Home Depot ups and try to get the flag
to that text.
And obviously it doesn't work even though we get a shall we get the Shayla's, Mamadu?
So it's strange, but we're going out to try and solve this one.
Right.
So over here, actually, when I was solving this CTF, I got a little bit confused.
Let me try and tired out of this one.
Maybe like with quitte or exit.
Now it doesn't work.
We lost this connection over here as well.
Right.
So let me out exit out of this one and just run this one more time.
And, yep, we managed to exit out of that one.
So we are in the user, Mamadu, over here.
But we cannot just get this connection as drops.
So you can try to reboot this in order to maybe trigger the execution of that Python file.
You can try to do pseudo reboot, but we don't even know the password for the Mamadu.
And as you can see, I'm trying some other solutions over here.
Maybe we can try to go into our candombe and try to get the notes that we have over here.
Maybe we can try this password in order to reboot these files over here at maybe the Mamadu has this
password.
Yep.
Mamadu has this password in the server as well.
But Mamadu cannot do that because he's not in the Soudas file.
As you can see, we cannot reboot that.
And magically, as you can see, we got the connection back from the server.
So if you run it, we are dev ops.
So how did it happen?
We didn't even do anything over here.
So it made me think that, yep, this is a grown up.
Right.
So it's been like running for some time.
So if you wait a couple of minutes, it's going to get executed.
It's going to give us the connection back.
So that's why I just tried to see the ground.
Maybe we can check for the Chrome tab as well.
But again, it should have been a chrome tab or it should have been a crown job because how else we
were going to get this right?
Just listening for our connection.
I'm waiting for a couple of minutes.
It got back the connection from the user dev ops.
So it doesn't work if we execute it on our own as user Mamadu, it actually works, but we get the connection
back.
As Mamadu But if we just do nothing and if we just start listening on our terminal, then we're going
to get this.
So it has to it should have been like a chrome tab or current job or something.
So it's been running in the background and it got executed and then we got back the connection.
Very good.
Now, over here in the shell that we have, let's try to go to home drops one more time.
And if we catch the flight to Texte now, we're going to get this flak.
As you can see, we get the second flag over here, which is very good.
So I'm going to take a note of this.
OK, so I'm going to Nonno into my notes that the extreme or not extreme and let me just save the flag,
too, as well.
Now, let me paint is over here and control or enter control x.
Here you go.
Now, there is one thing left to do which is becoming route because we are right now the ropes.
We're going to try and escalate our privileges one more time.
Right.
So that's what we're going to do within the next lecture together.