Hi, within this lecture, we're going to see if we can become real to using the admin user that we
currently swished and we're going to see what we can do to become rude.
So far, we know that we are edman right now.
And over here we are the user Apache's.
So now I have to shelfs right so I can use this shell in order to gain more privilege in this server.
So let me run Al-Saleh.
We are in the home admin user and see what we can do over here.
So as you can see, we have some binaries like cats mod and also we have grown up that peahi cryptid
pass that the encrypted pass that P y.
So let me get this out and see what we can do with those.
So chrome jpy it opens the top chrome results and it right.
Some string into it and it actually runs the, it opens the run this and executes that.
So this was our current job that we actually took leverage off in the previous lecture.
So here you go.
We have a cryptic pass that you see.
Let's see what it does.
So let me come over here, Krypto, pass the cryptid, pass that taxe.
So we have a kind of password or some kind of a hash over here.
So I'm just going to copy and take a note of that so that maybe we will decrypted later on.
Maybe we won't.
I don't know, but I'm just going to take some notes.
So I'm going to go into my notes that TXI and pasted over here.
Right.
So let me just paste it and just come back to our shell.
So this was the decrypted that passed out text.
We also have a script passed that while over here.
OK, so I believe this is the thing that cryptid that script to pass that text we're going to see.
Let me just Kat, who is your gun now that as you can see, there is another text file over here.
So this seems like another password.
So I'm just going to come over here and paste this into my notes as well.
So far, so good.
We are getting a lot of hashes, so I'm just going to save those and cut them out to see it anytime
I want.
Let me come back.
So here.
OK.
So I have to hashas and I also have one quick past IPY, so we suspect that this is the thing that crypts
this hashes over here.
So we get to see how it works.
So I'm going to say Cat Creped, pass that p y.
OK, great.
Pass that.
And here you go.
We have a basic python over here.
Python called over here and it actually uses some kind of base64 encryption and some other encryptions
like row 13 as well.
So I'm just going to copy this.
So if this is the thing that copy is and actually that encrypts all this hashes, we can reverse engineer
it and we can decrypt the file by writing our own python code.
Right.
So it's very easy.
Let me just show you how it's done.
I'm going to go into my free Salix folder one more time and I'm going to open a crypt up my file over
here with Nano and I'm going to paste this in.
So here you go.
This is our algorithm over here.
So what it does, it imparts the base64 cortex senses.
So far, so good.
So we have these libraries over here and then we have a function.
So it's called encode string, OK?
And it takes in a string and it uses some kind of encryption algorithms over here.
So it first uses let me just see base64 and then it returns the rote version of this and finally it
returns crypto results and it prints out the crypto results, actually, not the returns it.
So this is the thing that we should reverse engineer.
So again, this takes in string and it converts that string into the base64 encoding thingy and it returns
this it actually reverses that string.
OK, this does that base64 string and open parentheses, Colin, Colin minus one means reverse it and
then it uses codecs library to encode it with 13.
So algorithm is simple.
First convert it into base64, then reverse it and actually encrypt it one more time.
We throw thirteen and then princi that.
So what we should do over here decrypted we 13 reverse it and then decrypted with base64 one more time.
OK, so we have to just write the exact opposite of this algorithm.
So I'm going to just try this, OK?
I'm going to say python peahi atheel.
So we have this encryption.
So this is the string Attila's representation of the encryption algorithm.
Later on, when we write our own decrypt algorithm, we are going to see if we can get the atheel back
from that result.
So I'm going to write Chat's Creped Pi to see this because I'm going to copy this and I'm going to create
a new file called Decrypt that PBI over here and paste the thing in because we are going to change this
a little bit.
Right.
So I'm going to still import those libraries, but I'm going to change this to decode string.
It will take some string as an input one more time.
So I'm not changing this.
So rather than this first of all, I'm going to delete this, OK?
Because we should start with base64 decryption.
We start with the latest one with the 13 decryption.
Then we will return the base64 decryption.
OK, so I'm going to delete everything over here, including return.
I'm just going to leave this, OK?
I'm going to create a new variable called Decoded String and this will become codecs that decode this
time rather than code.
And it will just take in the string that we have supplied over here and reverse it and decrypt that.
We dropped 13.
Then I'm going to leave the exact same spaces as here and say return base64.
And I believe we have to say that be 64 DeCota up it goes like this base64 that B seeks to for decode
and we need to give the decoded string over here and over there.
So crypto results will be now decode string.
So this is the thing that we are looking for and we're going to print that result back.
So that's it.
That's all we need to do.
We managed to turn it into decrypts states, I believe we're going to try and see because we did exactly
the opposite of the encryption algorithm.
So this should work.
We turned down the road 13 and then we decoded the base64 as well, using the same algorithm, same
logic.
OK, so of course, in order to understand this, you should know a little bit python.
But I believe this is easy and you know that much.
So I'm going to try Python Decrypt IPY and I'm going to try and decrypt this one to see if this works.
If this works, it should give me until as back.
And here you go.
I have my own name over here, so I encrypted this before.
Now I can use the same decrypt API file in order to decrypt all this passwords over here.
So I don't know if their passwords, but they are some kind of lead at least.
So it says that this is all.
So we want to try.
I don't know.
So let me just decrypt this one and see what we get over here.
Let me copy this.
And here you go.
Let me just paste it one more time and hit enter.
Let there be foresty.
OK, so we know this to exist right now.
Most people with their passwords of the other users that we are going to try, but we don't know yet.
But we managed to decrypt this.
We managed to break it cryptology over a year, which is good, which is great.
So far, so good.
Where are you going to stop here and continue within the next one?