Hi, within this lecture, we're trying to finally become rude, by the way, little things that we
have gathered over here.
So first of all, I'm going to try to see what kind of passwords they are.
So we gathered some passwords in the previous lecture so far here I'm admin, so I'm going to get the
password over here to see what kind of users we have.
We know we have route, but I don't believe those passwords belong to root because there were hints
about free Østergaard and free Steed themselves.
So most probably one of them belongs to Foresty Gut.
And because we have seen this, who's your guard now?
That's why I thought that this belonged to Freaks Foresty Guts.
Of course, we're going to try and see.
Right.
So we have gathered this password.
We have gethers hash over here and we decrypted it over there.
So let there be foresty should be the password of the foresty gut.
But we don't know where you're going to try and see.
So I'm going to copy this one and come back over here and I'm admin over there.
So I'm going to run Supriyadi Gut and see what happens.
It says that standard in must be a twice.
So OK, so we don't have a shadow over here.
For some reason I'm going to try and spawn a show and then we can just try and run this one more time.
So I'm going to open my notes over there.
You know, the Python code that spawns I shall importunity.
Why?
So I'm going to do that.
OK, so let me just try this one or this one.
You can try either with Basche or S.H. and if it one doesn't work, the other might work.
So I'm going to start with the S h over here.
I believe you're in and I show.
But let me try and see.
OK, just make sure you post the video if you don't have that already.
So I'm going to come back over here and paste this thing in and.
Yep.
Let me paste the clip.
Clipboard or.
Yeah, here you go.
OK, now I hit enter.
It seems like it's worked so well where my admin Lizzi Sue Foresty got.
Here you go.
It asks for a password so it worked.
So I'm going to come back here and take the password one more time.
I'm going to copy this one.
OK, come back here and paste the password in and hit enter.
Here you go.
Now we are presented with a bash and if you're on, where am I?
We are foresty got.
So this is the third user that we are in.
So if you're on PVD, we are in the home admin so I'm going to go back.
We cannot even run.
I said I believe so.
Let me run that literally over here.
Yeah.
Here you go.
We have the CD Foresty Free Stick got for directory over here.
I'm going to CD into that.
And if I on that SLA, uh, nothing seems to be here in fact.
So we have the best logout profile in Benghazi, but I don't think this will do much in our case.
OK, so we're gonna have to use our standard procedure for privileged escalation and be very that within
the next section, we're going to deep dive into the privileged escalation and learn about a lot more
techniques than that we than we ever learned in this course.
OK, we get to learn one by one.
But right now I'm just going to run fine slash user frisee.
Got to see what kind of files do we have access to.
OK, and as you can see, we can see all the permission denied over here.
And it seems that we have a VAR folder, we have a free Steagles folder under var folder as well.
So this is always a good idea to see what kind of things that we have access to.
So I'm going to go into that folder.
OK, Arendelle, that's L.A..
So as you can see, we have a basic story and a secret admin stuff thingy.
So I'm going to get this out to see what kind of things can we do.
So this historic thing is might have been more active than in real life as well.
So I'm going to just get this out to see what kind of comments that have been executed on this user.
So as you can see, user previously executed, LSP, DNS, LJH and CD script admin stuff and apparently
admin stuff is a folder.
And inside of that folder there is a do come and do Comtesse.
So dukedom should be an executable.
So they have some kind of pseudo thing is going on over there, so maybe do call me some kind of stupid
binary like we have seen before.
For example, over here we see that pseudo you foresty.
So running this do come as free, Steve.
We are not free, Steve.
Are free to God.
And it runs, alas, for every file on that server.
And over here we see the pseudo you free the free Seagate's secret admin stuff.
Neukom Ellas and exit.
OK, so there is a binary called Do Come.
We are certain of that we can execute it and apparently we can run some kind of different things like
we can execute this dukedom is another user.
I don't know if we can execute this route or some other user or I don't know if this will help me if
I can execute this free steep as in this case.
OK, but it's worth a shot.
Right?
So I'm going to go into that folder.
I didn't know that was a folder.
I thought it was a file.
So I'm going to just CD into that Scribd admin stuff.
So if we groundlessly we see to do come and OK, so this belongs to root.
So it really doesn't matter if we run this as root or if we run this as foresty or something like that
because it already belongs to root.
If and I believe we have an issue, I'd permission over here.
So again, in the next section we're going to talk about acid's in a lot more detail.
OK, we have seen this in the Bendit section.
Maybe you haven't understood yet, at least the technicalities, but we're going to try and show you
much more in the following section.
So let me try to run this shuto, you free tingay and see if we can make it run.
OK, so it asks for a password.
Let me give the password and it says that.
So try again.
I believe we couldn't actually get the password for the free God.
Let me copy this one and come back here and paste the selection and enter.
Yep.
We can run this.
As you can see, I have for just testing purposes I ran these pseudo you free do come slashed you OK.
We can run this as another user apparently.
And in fact I really don't care about the another user part at all because what I have in mind is that
I run this executing a python reverse shell one more time, using this do come executable.
Since it belongs to root, it may we may get the chance to execute this as a root and get a reverse
callback from root user.
Right.
So that's what we did in previously.
And now we're going to do the same thing.
At least we will attempt to do the same thing.
So I'm going to come over here to one of our tabs.
I believe we have this python called a reverse charcoaled somewhere over here.
Right.
So I'm going to just try and find it.
So I'm going to go into my var w-w HDMI folder because that's where we put the Python shield up, right?
Yep.
Here you go.
That's the thing that I'm looking for.
So I'm going to not go into that and I'm going to see my IP is correct, but I'm going to change the
port because we are already using that.
So I'm going to just make it three three three three.
So I'm going to download this.
OK, so I'm going to start my Pache server.
I'm going to download this from my Apache server and put it in a in a folder where I can just reach
it so that I can execute it.
We do come.
So I'm inside of secret admin stuff.
Let me try to just download over here.
If it doesn't work, I'm going to go into the temp and do the same thing.
So I'm going to say Python held up.
Why?
And let me try to hit enter.
Yep.
Here you go.
It worked.
So I have the python scale over here.
So by using do come now I'm just going to do the do this thing over here, OK?
I'm going to try and run the exact same comment, but rather than less, I'm going to of course, try
and run the python file that we have downloaded over here.
We do come.
So whether we choose the stuff as a user over here or not, I don't know.
He was going to make a difference, but I'm just going to try this, so I'm going to run user in Python,
I know it exists because we have seen that before.
And I'm going to run the VA and there we are in the Foresty.
Right.
So Foresty got and a DOD secret admin stuff and finally the python shell that PEEVEY.
So let's try and see if we can do this.
OK, so it will run the do come executable and so that we will get the chance to execute this with Python
as route user.
And I don't know how this will work or not what we're going to see.
So I'm going to listen D for three, two, three, three over here and let me come back and hit, enter
and let's see if it works or not.
Here you go.
We have on this a show so if I run who am I.
We are finally rude.
So let me run the.
Yep we are in the secret admin stuff so I'm going to go back and let me repeatably.
Yep.
We are in rude so I'm going to interrupt Falder and Leslie and here you go.
Freestar leaks secrets that texte you can catch that and get your precious flag over here.
OK, so here you go.
Congratulations on meeting the leaks.
So this is our flag.
So as you can see, took a lot more to actually escalate our privileges than to actually hack in to
the server.
So I believe this was a good gate.
Good Bridgman for our way into the escalation section, privileges escalation section, because we're
going to deep dive into them in the next section.
OK, so the purpose of the CTF was to give you an idea about how hard this previously escalation can
get during practice and during real Pentair think we're going to deal with those in the upcoming section,
which is privilege escalation.