Hi, within this lecture, we're going to see how we can use this issue I.D. in order to become rude,
and in fact, we're going to start with a very hard one, OK?
We have seen that this user local been arrested.
So he's over there and we have a specialist who had permission over here.
So I'm going to just run it in.
As you can see, we get an output over here.
It says that calculating something, please wait.
And we see 99 percent and it's done.
So, as you can see, it doesn't do much.
It calculates something and it's a done.
So I don't know what it does.
And again, this is one of the most actually difficult thing that you can come across in any stupid
kind of exploit or excited kind of privileged escalation.
But we have seen the easy ones before.
Right.
So I'm going to show you something.
There is a comment called S Trace, and you can trace what a binary or a shared object does in order
to understand the logic behind it so that you can actually take leverage off if there is any vulnerability
in that particular file or a particular binary.
So over here, we're tracing what a binary does.
So that's exactly what we need because we know there is something going on in the suite as O, but we
don't know what it does.
So in order to understand this, I'm going to use this comment and I'm going to actually have to just
give the full path over here.
So this is user local been associated.
So so make sure you type exact same command over here and it's actually traces and sees what is happening
over there.
And as you can see, there's a lot of writing going on over here, like printing out, going on over
here.
So we actually cannot see much over there and we cannot even see the beginning of this file.
So what I'm going to do, I'm going to pipe this into more so that we can see what's going on.
And as you can see, it's very long.
We cannot understand anything from it.
It just prints out something like this.
So I'm going to clear this up and I'm going to run this one more time, but I'm going to pipe this to
more.
OK, so that we can see it in a better way.
So I'm going to do something like this, but it won't work.
As you can see, I just tried to just put the output in now, but it didn't work.
Yeah, the I believe the way to go is to put this in more, OK, so that we can see what's going on
in the beginning as well, because we need to find a clue in order to understand how we can leverage
this.
So I'm going to just pipe this into something like more.
And if I can make the piping sign.
Yep.
Here we go.
Just right more over here and hit enter and here you go.
Now we can see the beginning.
And as you can see, this is the beginning of this file or of this output.
So here we have a lot of information.
Just scan there's a little bit and see what happens.
Let me just go down a little bit so we have a lot of jibberish things going on over here like logs and
outputs.
I don't know any of this right now.
I'm just trying to make sense of something.
And as you can see, it says that we're trying to access some files, light inside, debug, and it
says no such file or directory over here.
So it's trying to access some files over here, but it cannot find it for some reason.
So, for example, preload, for example, this one.
So we have a lot of warnings and errors over here.
So, for example, he tries to open this as oh, that, too.
And I believe it opens this.
So there is nothing like an error over here.
But for some files, we have no such file or directory errors.
So this may be a clue why?
Because if we can actually create a file like that exact same file, then it will be accessed.
So if we can file, if we can find the file that will be executed like an [REMOVED] file or a file or
just a binary.
Then we can actually write our own exploits and make it run as root so that we can become root.
OK, so this is a little bit hard.
As I said before, it's not easy to find in real Pentax, but if you can find it, then you will just
find it big.
OK, you can get a big reward out of it.
You can become rude.
You can do whatever you want.
So over here we can see how it's done.
And again, we will find a file so that it's going to be accessed or it's going to be executed and we're
going to try and create that file on our own.
So we need to find no such file or directory errors over here.
OK, if you go down with your arrow keys or by hitting enter, you will see there are a lot of them.
So what I'm going to do, I'm going to just filter this out a little bit to understand what kind of
files that we cannot find.
So rather than piping this to more, I'm going to pipe this to GRAP and I'm going to search for no files.
So in order to do that, you have to write, i.e. open and then with a Peiping sign access and then
no such files.
So it's either going to be open or access or no such file and we're going to see every one of those
lines over here, OK?
Of course, you can go for the access, but it will show you also the accessed files that files those
files that really exist.
So we really need no such files over here.
So here you go.
We found those steps like it tries to access this Etsy Usted debug, but there is no such file or directory.
So we try to access this, but no such file or directory.
And I believe we have to go for the open rather than access.
So we know it's going to be opened and we know it's going to be executed.
And in this case, for example, there's an open over here and it actually ends with asso extension.
So I believe this is a way to go or this is our best bet.
So I believe we can go for this.
And if it doesn't work, we can always come back and try for the others as well.
So we are in the home user, so most probably we can actually reach this file or folder over here.
So let me see.
So this is config and we don't actually have a config folder over here as well.
OK, so since this is in the user folder, it will be actually possible for us to create that folder
and create the file as well.
So if it was in another user's file or folder, then it would be not possible for us to do that.
For example, I don't know if we can actually create a file called as no no how cap or something like
that and put it in the Etsy folder, because maybe we don't have permission for that, but we definitely
have permission for our own user folder, which is Vivia going for the last one here as well.
OK, so you can try the other ones here, like Etsy or like Leyb.
But since we are user, it won't be possible for us to do that.
Most probably.
I don't know, maybe we can try that.
But again, it's our best bet.
So if I make that config, I can just see that config folder over here like this and I can go into that.
And here you go.
Now, if I just want to create like something like that so I can just write Nano Lipka that as Flipkart
that see first, of course, we're going to write the C code and just compile it into a shared object
file later on.
And again, you don't have to know C in order to do this.
I'm just going to show you a very simple C code and I will put it in the tray Hackney tasks as well.
So first I'm going to include the standard IO over here and also the standard library over here like
that.
And after we import the libraries that we're going to using this code, we're just going to go for in
it or just create a constructor attribute.
OK, you can get the code from here like this, OK?
And if you know, see, this will be very easy for you.
And if you don't know C, maybe it will be a little bit complicated.
But if you know any.
Alarming language, at least you will understand the logic.
So what does static void mean?
So if you got any kind of Java cards or any seekers', you know, this static means it can be reached
from anywhere in the project.
And void means and it's actually saved in a different kind of area in the ram.
And void means it will return nothing.
OK.
It will return Manado.
And we are creating a method over here.
And so even if you have a different name for this method in the documentation, in my task, practically,
we can call this anything we want, like I will call it my name.
So Atheel.
And this will be a special attribute like this.
OK, so a dash dash attribute and not dash actually underscore, attribute, underscore and this will
just take in the constructor.
OK, so this is our special method over here.
Make sure you put on the semicolon at the end and now we're going to write what will happen when we
execute this and then we decide of that method.
We can just specify what to do.
So again, I'm going to create a void over here and I'm going to call the same thing until and I will
put curly braces right now like that and make sure you put one tab over here.
OK, one, two, three, four spaces.
So after four spaces, I can just run system and we're going to execute this on the system.
So what are we going to do?
We're going to copy the Basche and we're going to give the inside permission to bash and then we're
going to just open the bags, postpone the shell so that we can become root.
And again, this will be executed by root.
So it will be good for us because.
Why?
Because we know sweet as O is owned by Root and we have given the special permission to access it.
So let me write what we are going to do over here.
So this will be in between the double quotation marks.
So I'm going to copy the bin bash over there, OK, and I'm going to copy it under the TMP folder like
this.
And then you can just write and like this in and then I'm going to give the mode plus s, which is going
to give us the Usted permission to Tempy Bash.
And then it will be very good for us because we can just run the bin bash from the user as well.
And you can just spawn bitmap Kaspi over here.
So it's actually a one line code like this and it's not even a C code.
It's just doing something with the system.
So it will be run as a command.
And the command that you should run is over here.
And again, we're just going to let the root run this comment for us.
So far, so good.
This is the whole thing that you should run.
OK, so this is kind of developing your own exploit, but if you don't know C again, it's fine.
Just understand that we are making root around this thing so that it can copy the back into Tempy and
given its UID permission to it so that we can spawn it like that.
OK, so far so good.
You can say this by control all and just entered out of this with control x so that we can see the leap
that C over here under the config folder.
OK.
And of course we're going to have to just convert it into as oh and then we can just put it very long.
So far we only have the leap that C over here and I'm going to use the same document that we have seen
before.
And you can actually reach this comment from the task, from the Try Hackney website as well.
So I'm going to just put this under the home user dot com config that as o and I'm going to give the
input as home user that config that C like this, OK, and it says that no such file or directory and
lets.
Yeah.
I didn't put the dash over here so it should be output like this and this is our input.
OK, so if I hit enter now it will be converted into an S o file like that.
So if I run the SLA.
Here you go.
Now you have the Lipka that says, oh now we have the file that hasn't been found before.
Now if we run the same is Eweida.
As o thingy that we have found when we actually search for find search with the find comment now, it
should make us root.
Let me find that comment or let me find the path over here.
Here you go.
So this is the thing that we should run now.
If I hit enter on this, it will get executed.
And hopefully now this time it will find Dileep, Cut-out, Asso and Leaphart.
That is all will get executed.
And here you go.
Now we get a Backshall over here.
So the bag shall if on where my real root is.
You can see we managed to escalate our privilege with a very sophisticated way.
So you can do this, you can actually search for is your I.D. and you, if you find the binary you can
just do the trace and see if there is any vulnerability like this and get a hold of it.
So again, this is one of the hardest things that you can encounter on a pentathlete or CTF.
So this is not like a very beginner challenge.
I give you that.
But also we we also seen the easy ones before.
And right now, you know what that nationwide is.
And also you need to learn about the advanced stuff here as well.
So, again, this is a very good example of intermediate advanced kind of CTS of privilege escalations
for you.
So if you got confused at any point, please make sure you just watched his lecture again.
Please make sure you scan the code that we have written in the tri.
Hack me a website in the task in this specific related task.
And you can try this on your own if you haven't done yet.
OK, so you can actually find the comments or hear for your convenience as well.
But I suggest you just take that as a note because you will need that a lot during these ETFs.
If we exit out of this one, as you can see now, it completes the suite I saw over here and we're back
with the user shall.
Now it's done.
I believe this is time to stop here and continue with the next lecture.
But again, leveraging stupid but in different ways.