Hi, within this lecture, we're going to try and escalate our privileges one last time because we're
going to be rude eventually if we can manage it, of course.
So right now, we are the devil we were, Mamadu.
So we are making our way to the top.
So let me close everything over here, OK?
And try to focus over there.
So right now, we're dev ops and we want to be rude.
So how do we do that?
Let me show you another technique that we can use other than find.
So I'm going to open my notes one more time and let me scroll down a little bit and show you something.
So as you can see, there are a couple of automated tools that we're going to dive into later on.
And here you go.
As you can see, we have this command called Pseudo Dash L, So it's a very simple comment, OK?
And it actually gives us what we can do as a sudar or as an administrator user.
And it works OK, just around Studwell and you will see what kind of things that we can run like, as
if we are an administrator user so we can actually run the pip over here.
So user Delfs may run the following commands like Canada and it's not like a set UID thingy.
So this is very common.
OK, so a route or administrator can decide to give permissions to run some kind of binaries like this
one to the users or to some groups like developer groups, because it's necessary on the server.
Right.
Like in this case we can run Pip.
So what can we do with Pip?
Pip is a Python package manager.
If you don't know what it is, I hope you know a little bit python so you can understand what we are
doing over here.
And I'm going to show you what we can do with it.
I'm going to run user bimbette and exploit, OK?
And of course, pseudo something like that in Google.
So once you do that, you will see a lot of tools over there.
So it's a common thing.
Yeah, apparently.
And there is something called fake Pip.
So fake Pip, you can't just search for that as well.
So as you can see, it says that it's exploit Sudar with user install and that is exactly what we are
trying to do over here.
Right.
So as you can see, it gives the same demonstration over here.
They run pseudo URL and they listed this Tingay.
And over here, if we can go to the command itself, it's kind of what we have actually run in the previous
lecture.
OK, it's doing a reverse shell.
Of course, that's how we are going to get the shell and we have the thing going on over there.
So of course, we're going to have to change the whole system part one more time, at least the host
itself.
But we can actually use this.
So how do we use this over here?
Apparently in the GitHub of this guy, we see the instructions we can run this OK, user been pip install,
upgrade, first reinstall, but we have to download the setup via file into remote target and execute
this in local folder.
So first of all, we're going to have to download this or just copy and paste the code into our server,
into our target server.
So we are currently in the target server, right.
As Mamadu first and now with that ops.
So first of all, we're going to have to download that, set up the PRI file into the target.
And if we actually execute that in the local folder, then we're going to get back some connection and
hopefully this connection will be sent as a route.
So in order to copy this, you can just come over here like we have learnt in the Bendat.
Just copy this.
Get over here and try to clone it.
Right.
Let's try and see.
Yep.
Clear doesn't work.
We don't even have like a proper shadow over here and we don't even have a git command as well.
So let's see, we have we get OK, we can try to run, we get we get this kind of downloading something.
OK, so let me try to download everything over here.
And see, yes, if you say yes, we can see fake pipe over here, let me go into the fake pipe and see
if we can get it.
No, we cannot see into the fake pipe.
OK, so I believe there is something wrong over here.
Let's try one more time.
Nope, it doesn't work if you're on the let's fake it.
Seize over there.
But we cannot see into that.
There's something wrong if we say Al-Saleh.
And here you go.
I believe this thinks that fake pipe isn't a folder, but it's a file.
But I believe you're downloading it in a wrong way.
So let me just run the we get over here and see what's going on.
And this is not what I expect to write.
So let me just copy this from here and come over there and try to re get it under control over here
in our own color, Linux to see what's wrong over there.
OK, so let me run it.
Let's let me into that.
Yeah.
It says that it's not a directory, it's a file apparently.
So let me save file fake pip.
Yeah.
It's some HTML document.
So it doesn't clone or it doesn't download the Python codes, but it actually downloads the HDMI folder.
So I'm just going to clone this on my own index.
So let me remove this fake paper over here, OK.
And I'm just going to get clone the thing so that we can actually see the Python code, at least in
our own color Linux, then maybe we can try to move that file to our remote server.
So I'm going to go into the fake paper right now.
Yep, here we go.
Now, let's try to find the setup that p right.
Here you go.
Now, we want to just take the take everything inside of the set up that way and just move them into
our server and let me change this localhost over here.
I'm going to say Tanno two four which is my own colonics IP and for port you can just keep it.
And over here let's see if we have some kind of IP stuff over there.
Nope.
Yeah.
Al Hosten Allport is embedded as a variable over here, so we don't have to change anything else.
So for our part you can leave it as it is or you can choose any other path if it doesn't work for you.
But make sure you don't do this.
One, two, three, four, because we already use that.
OK, so I'm going to try and just send the setup that y to our server so you can just copy and pasting
this thing or you can even write it on your own in the server as well.
And you can try to do it in a more, I don't know, complex way, like try to put this into your own
Apache server and just try to we get it from there.
For example, let me just clear this stuff and let me try to copy the set up the PVI into my var w w
w HDMI folder, which is my Apache to server route folder, if you know what I mean.
Now what I'm going to do, I'm going to just say service Apache to start in order to make my approach
to server run.
And now I have a website running on over here and inside of my website.
I have set up that P right now.
I will just reach that set up that P right from my own colonics from the target server.
Right.
If I come over here I can write Tenno too far.
And so I set up that P by now I can reach that file.
Of course we are going to have to do this in the server, not in the local machine.
And we can easily do that by running.
We get and say like https we get.
I have to htp not htp.
Sorry, we're gonna have to specify the whole path over here rather than just one or two four.
So like this htp tenno two for setup that PBI.
OK, so if you hit enter it will download it.
And now if I run that SLA.
Here you go.
Now we see the setup that P right over here.
Now if you remember the instructions, it says that just download the setup that PBI into your target
machine.
And that's exactly what we did.
Right.
We managed to just get this setup that play into our target machine.
And it was actually nice to change the IP address from colonics as well so that we don't deal that deal
with it inside of the target server.
Maybe we.
Don't even have Nano or rim over here, we don't know yet.
OK, so what I'm going to do, I'm going to listen for income, incoming corrections for the poor,
13 three seven two, because that's our outport is right.
So what I'm going to do next, I'm going to go back to this fake pimp and just run the thing that it
asks us to run.
So we're going to run the user being pimp install and we going to install and upgrade our for first
install the thing over here.
And we are running this as pseudo as you can see.
We're running it with pseudo comment.
And here you go.
Now it has been executed.
We can run this with pseudocode.
MANDVI Why?
Because it's it's allowing us to do so.
And if you come over here to your callisthenics, you're finally rude.
So this fake pimp does work.
OK, thanks for this guy.
OK, and if you're on, who am I?
We are again, rude.
So if we run, unless we can see we are inside of some folder, if you run locate route that you can
see that it's in the seed root folder, you can go for the route or you can just cut this out, not
see the route, but cat route through text.
And here you go.
We have the final flag over here.
So we managed to solve the candombe.
So if you're thinking that, yeah, we managed to solve it and I understood everything, but there are
a lot of ways to go.
So how did you know which way to go?
Of course, there are a lot of leads and we're going to cover them in the privileged escalation sections
again during this course.
And we're going to cover a lot of gaining access information here as well.
Remember that this is not the first time that I'm solving this KTRV.
I've saw this couple of years ago and took me a lot more than one hour or one and a half hour.
I don't know how many how much time that we spent on this one.
Now, it took me less because I almost knew which direction to go.
I didn't remember everything, but it was easy for me to guide myself through something, for example,
for the current type thing or from Chrome Cronje uptake.
I was listening for the incoming connection.
If I wasn't listening for the incoming connection, then I wouldn't have got the connection back from
the server.
Then I wouldn't have the chance to understand that it's being executed on its own.
And maybe I would think that, yeah, I'm getting back the connection.
But as a Mamadu, not Daboub soldier or user.
But anyhow, we got the root flag.
I'm just going to make a note of that as well.
Again, don't worry about the alternative stuff.
We're going to learn a lot of alternatives during the course.
This is why we are doing it in the first place.
OK, so I'm going to come over here and just ride through text and just pasted over there.
See you in the next section.