Hi, within this lecture, we're going to see what we can do to escalate our privileges because we are
currently in the server as user Apache and we're going to see what we can do to make our way up.
So what I'm going to do, I'm going to, of course, Kathy, password to be starting.
OK, and here we have the route, of course.
And let's see what we can see over here.
We have the Apache, which is where we are currently m and we have is Epizyme.
And we have quite various users over here.
Like we have easy peasy.
We have admin, we have free God and we have frisee itself.
So I don't know, maybe we are going to see every one of those.
Maybe we're going to just jump right into some of those and make our way up from there.
So I'm going to cut that issue to see if we get any kind of description over here.
So NUPE, we just see the goal and the IP address over there.
So let's see what else we can get over here.
So I'm going to try to go into the users, OK?
And let me see where we are.
We are in the route right now.
If we run L.A., we can see the current folders and files that are available to us.
Let's see if we can go to route.
I'm going to succeed route.
Of course, we cannot do that.
OK, maybe we can go to some other users folder.
Maybe we can find some kind of lead over there.
So I'm going to go to home.
And as you can see in the home, we have admin, easy peasy and foresty got.
So I'm going to go into admin, OK?
I cannot do that.
I'm going to go into easy peasy.
And here you go.
We can't do that.
And if we run, unless we have a lot of files and folders over here, apparently, OK, we have make
dive.
We have let me run the SLA and see it in a better way.
So over here in the easy peasy, we have some kind of hidden files and folders over here, OK?
And we have, I believe, some kind of binaries as well, like S.H., more charm.
And let's see, we have Nano and yeah, we have not stopped Steve, which is good because we can read
it, I believe looking for the I'm looking for permissions.
I'm going to get the notes that text and here you go.
It says, Yoaz, I made it possible for you to do some automated checks.
I did only I love your access to user been system binaries so we can run some binaries in the user folder,
which is good.
I did we were a copy a few extra often needed comments to my home directory, which is S.H. Mode, the
F cat and copes crap and so many more.
Great.
Don't forget to specify the full path for each binary so we can actually use those binaries in order
to create a reverse shuttle.
I believe and we have a big tip over here, he says that just put a file called Run This in the temp,
OK, each line within one comment.
So we have to specify our wine line.
You're over here to run those binaries, as far as I understand, so we can run around some binaries
as admin user, but we have to create a file in order to do that.
But we cannot KDA into that folder.
So I believe we're going to have to see what kind of things we have over there by running an SLA or
something like that.
Let's see if we can check the notes that using this.
Nope, we cannot do that.
Even though they copy these binaries into the admin folder, we cannot directly reach it.
We cannot write directly execute them.
So if we could have done that, then it would make our way easier because we can run some binary commands
and but there is a way to do that.
It says I just put a file called Run This into AMPE and each Lemont each line.
Should one include the one comment, then the output goes to the file.
Crohn result in the temp and it should run every minute with my account privileges.
So there is a chrome tab going on over here.
Cron job, OK, and in that cron job it runs the run this file every minute.
And if we can specify a one liner over there to run a binary and privilege escalator's privilege mode,
then we can get a reversion back to us, then we can be admin user.
I don't know if it will lead us to the root, but most probably it will.
And its administrator user, maybe we can actually go into the root by not doing so many things later
on.
Right.
So I'm going to do exactly like instructed over here.
First of all, I'm going to see what kind of binaries under the user bin to see if we can run Python,
for example.
Let me see if we can run Python.
And here you go.
I lost the show and of course, in order to gain the show, I'm going to run an agency and we Alpay
one to two for one more time.
And I'm going to have to go into the Firefox and run this version one more time and let's see if we
can get this over here.
So 10 to 16 and CYO uploads shelled out PMG or that PMG.
Here you go.
I believe it works.
Here you go.
I have to you one more time.
So great.
I don't know if we have the python or not.
So I'm going to run unless and I'm going to go to the home folder one more time and into the easy peasy
to see that node one more time.
I'm going to run Al-Saleh SLA.
Here you go.
I'm going to get the NATO xda and here we are.
So far I tried to see if we have Python over here and I failed to do that.
So we're going to have to take a different result over here.
And first of all, I'm really I really need to see what kind of think that I should put into the run
this file.
So I'm going to try and let's allow into this user and see what kind of things that we have over there,
OK?
And we're going to try and if we can have a python running over here, then we're going to try that.
So what I'm going to do, I'm going to unless I play into the user bin and see all the available binaries
for me.
So right away.
And user slash bin, here you go.
I believe we managed to see that.
And we have a lot of things going on over here.
As you can see, we have a lot of binaries inside of our server.
And I think we should do grep because it will take some time to find it from here.
So I'm going to say, unless L-A user bin and I'm going to pipe this into the grep and I'm going to
grab the python and here we have the python.
I believe we only have Python two, but it's OK, right, because we have the reverse scale codes for
Python two independent monkey.
We can take leverage of that.
And if we can make this work, then I can just create a ram this file as they use the python and just
execute this file, for example.
OK, so I'm going to go for the Panthers monkey one more time and I'm going to search for Python reverse
Shokichi like we have done before.
I'm going to open the Panthers monkey.
And if you cannot go into the Panthers monkey, by the way, you can just use what I'm using.
You can just type the python comments.
I believe you right now.
You see how this works.
OK, so let's open a new tab and do this in the local and we can just do this under the free folder.
I'm going to open and now Python shall dot p y over here.
OK, so I'm going to paste this thing in.
And since this is a one liner, we can just put this in there on this folder as well, but it won't
know how to run the python from the user binaries.
So what I'm going to do, I'm just going to turn this into a regular python called, as we have done
before.
OK, I'm going to import the library's SOCAP subprocess and the operating system libraries over here.
So I'm going to define the Zucchet as s.
So this is how the circuit works, as you might remember.
And over here, I'm just going to give my own IP address.
And we need to change the port here as well, because we have used the one, two, three, four.
I'm going to make it Phi Phi Phi Phi Phi, but you can just use any port that you want that is not in
currently use.
OK, so I'm coming over here to delete the semicolons because we don't need them in the regular python
code.
And here you go.
So it will give us some as a child and I'm going to delete those things as well.
So here you go.
Our Python code is ready.
If you want, you can just post this video and write it on your own.
Make sure you write exactly like what you have seen over there.
So let me get this.
And here you go.
So I'm going to take this and put it into my Web server over here, OK, in my user var e-mail folder.
So wah wah slash double level W and slash HTML.
So this copy that thing.
So I'm going to run my Pache server like we have done before.
So I have a python child up in my Pache server.
So what I'm going to do, I'm going to just use we get over here and as you can see we have the we yet.
So I'm going to go on the stamp because that's where we should actually execute this, as you can see
in the top.
We don't have anything right now, but we're going to have soon if I run this correct.
So we get HTP or too far for me and write your own IP address over here in order to test this and just
write the thing that you have just copied.
And here you go.
I managed to download the Python shell in my server, so I'm going to run this cat.
And here you go.
We have the python shell.
So rather than trying to run this python shall over here, we can actually run this by Dongzhou right
now.
But it will give us the shell, but it will give us the shell as the current user that we are in, as
in I believe we are in the Apache user in order to get this in a privileged way, in an escalated privileged
way, we need to make this run with the current job it was talking about so that it can run as admin
user.
So what we are going to do, we're going to do as instructed before.
We're going to have to create a run this file and in that run this file, we have to specify something.
So in order to do that, I'm going to just run echo and say user being Python.
OK, so it's going to use the python over here under the user bin folder and it's going to execute the
top python shell that pivo and don't forget to place a space between them.
And I'm going to put this into a file called Run This.
And since we are currently in the TMP folder, we can just execute this over here.
OK, I'm going to run this.
It will be run within one minute.
I believe, as you can see, if you run it, let's play.
We can see this if you're on Ketron this, it will just run this command and it also complies with the
one line rule as well.
So I'm going to say and can we help Phi Phi Phi Phi Phi over here?
And within one minute it should get executed.
OK, let me run it one more time.
As you can see, this will create something called, I believe, result chrome or something like that.
And once we see that it will it will mean that it gets it gets executed in a regular way.
Let's see how this thing was called.
Let me come over here to top and see if we can get the note back and it will pass some time as well.
Here you go.
Yeah, it will just create a file called Chrome Result, OK, in the TMB.
So if you see the chrome result, it means that it got executed.
So this is not a rule in a regular server.
This is the rule that others CTF made possible.
Right.
So if I run, I was like, here you go.
You see the chrome result.
Let me go back and here you go.
We have the S.H. Show.
So if you're on, who am I?
We are admin right now.
So we managed to become admin, but I believe we are not currently Ruzzo, so we cannot go and be rude
directly.
So let me get the ATSE password over.
Here we are.
We can see the route, we can see the admin.
But there are some couple of other users here as well.
So we might take a look at those ones as well in the upcoming lecture.