Hi, within this lecture, we're going to see assorted permissions one more time, and actually this
is, again, an advanced way of exploitation in order to escalate our privileges.
So we are in the task 15 over here, file permissions, assurity bindery.
So we're going to see how it works and we're going to work with environment variables over here or path.
And you're going to see whether this in a minute.
Now I'm going to right around the find thing that we have been running so far.
OK, I'm going to search for the type of I'm going to find the permissions over here and just on that
list and just put the output in dev null.
But for some reason, it hasn't been executed or.
Yep.
Here you go.
I have to say type and f like this with dash type.
OK, so here we have seen the [REMOVED] over here, but also we have the sweet end.
So as you ID ends, this is another binary that we have seen before, but we haven't looked into it.
So right now I'm just going to focus on this.
OK, in our case, in our scenario, we've found and Usted per mission over here and we are trying to
understand what it does.
Once we were on that it say starting venturer Apache to EBD and it says already running.
So most probably does acidy or this binary starts Apache server.
OK, and in order to confirm this, we can try a multiple things like we can run estrus as we have seen
before, we can try string's, which is another way of seeing that.
So let me just try this with as trace, OK, and run this.
So here you go.
What can we see with the asterisks?
Let's see.
So it says that again, we have no such file or directory is over here, but we have already covered
that.
Maybe there is a way to actually do this one more time within this binary as well.
But we already covered that in the previous lecture.
So we see operation not permitted over here with set use ID or arrested over here.
So we have the Panchita permission denied for some reason.
OK, so it's definitely trying to start the Apache to.
We already seen it in the logs and we already seen it over here as well.
So there's something going on with the Apache, OK, it says permission denied.
I don't know why it's saying that, because in my opinion, it gives us the service is already running
thingee.
So it should have been executed.
So I'm going to run this with strings.
So if you run something with strings, you can't see the strings that you can find.
It doesn't always give you the best result because this is a binary.
We cannot get the whole source code or something like that.
But if the source code or if it does something with the commands, with a string like this, for example,
running service Apache to start in this case, we can actually see it.
OK, so running strings may not give you the best output, but we can see some kind of clues like this.
So in this case, we know that this is UID binary is trying to run service Apache to start.
So we already knew that, but we didn't know how it ran that.
So it's actually run that with a command like this service Apache to start.
So let me show you something.
What does service do if we're on service?
It actually runs that binary actually runs an executable.
Right.
And it gives us how we can use it.
So it's the same thing with Python, actually, but we don't have Python over here.
So let me show you my own Karlee.
If I run Python, I go into the python, Shali and I can just run Python codes like this.
So let me exit out of this one.
And I believe I have to write it like this.
So the question is, how does Linux understand when I run service or when I run Python or when I run
something else?
So there must be a logic.
And the logic behind it is the environment variables or the path that we're going to see in this lecture.
So it's the same in the Linux, it's same in Windows, and it's same in the Mac.
As well, so we define some variables in an environment and then we run this, the operating system
will know where to look at it.
So in this case, it's looking at some folders.
And if it finds the service binary transit, it executes it.
If it finds the pattern that it executes it, OK, if it doesn't find if we don't give that information
to the operating system, it cannot find it.
So maybe in our server, Python is installed, but it doesn't know where it's located.
So if you run print the same path like this, you can see your own path.
So in this case, we get some no such father or directory over here, but also we see the user, Ben.
So whatever resides under user local Benfold there, for example, it will be found and it will be executed.
Once I write something over here, for example, Python should be under the user local bin.
So if we go to user local bin like this, OK, or user bin, it really doesn't matter.
Just go to user user slash bin.
You will see a lot of folders or a lot of executables over here, like zip, zip, clog, something
like this.
OK, so there are a lot of executables and this is how actually my Linux knows when I write something,
for example, if I write zip over here within any folder, OK, not in the user bin it knows to look
at in user bin because it's defined in the path.
OK, so if I run the zip code for example, I don't even know what zip cloak is.
It will find it under user bin and it will execute it like this because it's defined in the path.
Once I write this, it finds that it tries to find it in the user bin, user, local bin and every other
folder that is defined in path.
So what I mean is I can if I can change the service, for example, rather than it finds the original
service in the path, maybe it can find my own version of service or something called service, like
an executable that will lead me to an escalated privilege.
Then I can become root.
Right.
So it's hard to do.
We don't know whether we can change the path in a way that we want, but it's worth a shot because there
is an inside binary that runs this command and we we are certain of that.
We can see it in the strings.
So why not?
We tried this.
That's what we are going to do within the next lecture.