Hi, within this lecture, we're going to try and become rude by exploiting the environment, variables
or path like we have discussed in the previous lecture.
OK, so far we know that this assisted binary is trying to run the service Apache to start.
So I'm going to see if we can make our own way of service and make sure Linux finds it first rather
than finding the regular service binary or regular service executable so that it gets executed by route
and we become route.
So let's see how it works.
OK, again, we're going to create a file for us.
We're going to try and create an executable and then we will make it in the path.
So let me show you how it works.
First, I'm going to create a key file and I'm going to use exactly what we have used before.
And I'm just going to do this in one line so you can just take in all of this as well.
I'm going to echo the C-code in the file because I don't know whether we have nanowire here or vem.
And I mean, I know we have it, but I just wanted to show you this as well.
So you have to write Echo with a single quotation mark in main.
OK, so this is our entry point for our C code and it will return an integer and it doesn't mean that
we have to return a specific one.
We can just return whatever we want over here.
OK, this is our main entry point.
Main method over there.
So I'm going to write our code under this main method.
And again, I'm just going to use the set ID set UID tingay that we have seen before and be very nice.
If you don't have nanogram in an environment that you can just use this.
So open the calibration.
Right, said Jidi to zero.
OK, so this zero is important actually.
So the JIDE zero and UID zero stands for the root.
So make sure you are exactly right like this.
OK, said Jide zero semicolon setted zero semicolon and then just use the system in order to spawn the
Basche which is slash being slash Basche like this.
OK, and then you can just return a number over here because we executed this or written this with Int
Main.
OK, so it expects to return some integer which is a whole number actually.
If you don't know whether the integer is so this will return zero.
And again, it's not very important what we return over here and let me just delete this parentheses
and replace it with curly brace because I believe that's the way we should do it like that.
Yeah.
Here you go.
Now I believe we are.
OK, now I'm going to write this under a file under the temp folder called file called Service.
OK, now we have the service.
Let me get this out.
So this is service.
Here you go.
Of course, this is just the code itself.
Now, I believe we have to make this executable so that it can be executed when it's reached.
OK, well, it's reached by the user or rence reached by the usted end file, OK?
And I believe we have to make sure that.
Let me just do this one more time.
We have to make sure that I run this service, see, OK, because this is the C code and then we're
going to convert this into an executable and call that C, OK, so I'm going to run this C temp service,
Stazi, and the output will be temp service like this.
So let me run SLA and see if it has overridden it.
So let me try this play on temp actually.
And here you go.
Yeah, we have the service, that's the service executable.
This is the thing that we are looking for now.
We managed to convert this into executable and if we can make our Linux's the service first before the
original service that has been put under user bean or something like that, then it will work.
Right.
Let's see if we can actually do that.
So far, we haven't changed anything regarding to Pat right now and this is how you do it.
You have to use expert comment and right path and just assign a path over here.
So if you if we write TMP with a column path like this, then TMP will be put.
In part, so this is exactly the comment that you should run, and now if I print the path now, as
you can see, Tempy actually is shown in the first place.
Now, if it's shown in the first place, then we are good to go because this is how it works.
It works in order.
OK, if it finds service under Tampoe, then that's it.
It will not go and execute the one in the user local bin.
It will execute the one in the top.
OK, and now since we can export this path, then it's very good for us because now we have the service
executable under Tampoe and if we can actually run the thing that we have been working on.
Let me just run this find command one more time and let's change the type like this, OK?
And here you go.
Yeah, that's the that's the thing that I'm talking about.
This is user local, been inside and why we're here.
So if we run this, it will run service Apache to start end rather than original service under the user
bin or user local bin.
It will find the service executable that we run.
And here you go then.
Right.
Where am I.
We are route again.
This is kind of advanced, OK?
It's hard to find.
It's hard to detect in a real life environment.
So it was obvious over here because it has been named like as Eweida and something like this so that
we can understand at least get a clue of what's going on.
And you can see the details over here in the task here as well.
You can just get the code from here as well.
But again, if you get this, it will be big.
OK, so I wanted to show you all of this things, all of this important things.
And I really suggest you take a note of that in your own CTF challenge files.
And again, I have shown you mine.
And in fact, I believe I have to take this note as well.
But because I don't have it over here, right.
So I have this pseudo dash l and I'm going to do the same thing over here.
I'm just going to take a note of this because I use this a lot in setpiece.
If I find some way to just execute a second or a binary or a shared object, then I will use this,
OK?
It will be very beneficial for you.
And again, you should you should take note of this as well.
I believe I already have this, but I will see if I have it over here.
Let's see.
Yeah, here you go.
I have this thing over here, but I can always search for the alternative one over here as well.
So far, so good.
Now, again, these are all advanced things, but we have seen the basics once basic once before.
And maybe you can just take a note of this exploitation, the long C code that we have from before,
because it's good as well.
OK, so make sure you just put those things in the right place.
And here you go.
Now we are ready.
So I believe these this section was a little bit hard.
But again, once you get to actually sold the seats and once you get to have a little bit experience
on those, then it will be better for you.
It will be easier for you in time.
So far, so good.
I'm going to stop here and continue within the next lecture.