Hi, we didn't this lecture, we're going to deep dive into the grown ups that we have actually covered
before in Bendat, we have seen a lot of grown ups and also exploited them in order to gain access to
the next level or in order to escalate our privilege.
So that's exactly what we are going to do within these lectures.
But also we're going to deep dive into the current jobs now so that we can understand the theory in
a better way, so that you can use it in your own good for upcoming acts or penetration test during
your career.
So let me locate the chromed over here, because I cannot seem to find the etsi cronie, as you can
see.
So I have a chromed over there.
Like if I try to get this, it says that this is a directory.
So let me address into that and see what we have over there.
And apparently there is nothing over there.
Let me run Al-Saleh and here you go.
There is nothing over here but just a placeholder file which is hidden.
And I don't think we have anything in the currency.
But this is not the only thing that we should look for.
We also have to look for Chrome tab.
So if you can't the Azzi Chrome tab, you can see the chrome jobs that resides in your system as well.
And you will get a more detailed look like this and remember what the current job is.
So it's kind of a service that runs in background and it's scheduled so we can actually make it run
in any time we want.
And over here we see the shell and the path it uses.
So let's see what else we have here.
As you can see, we have a lot of comments or dare in.
These are individual chrome jobs.
So we're going to talk about what these stars mean.
And over here, we can see the comment that it runs.
So over here, we actually see some kind of CDX comment and we can see the ETSI Chrome daily, chrome
weekly, chrome monthly.
So it doesn't mean that it necessarily has to have those names over here, like daily, weekly, monthly.
We can actually see where we actually run this or when we actually run this and we going to deep dive
into that.
And over here we see some overwrite that as H and also the compressed as over here.
So next thing we can do, maybe we can try to just see what this alright that S.H. does.
OK, so I'm going to get this and see if we can actually see this.
It says that no such file or directory and it belongs to root.
And as you can see, we run Al-Saleh, we cannot actually see it.
So it isn't really there.
So maybe it's something in the path, like maybe it's under the user, local or user, local being.
We are in the home user folder right now, so it doesn't mean necessarily that it should be in the home
user directory.
So maybe it's in somewhere else in the path.
OK, but in this case we can actually see the whole path over here.
So user local being compressed at S.H. so I can just get that and get to see what happens inside of
it.
As you can see, this file really exists.
OK, so there is nothing wrong over here.
But I believe the overwrite S.H. doesn't exist or it exists in some other folder rather than home user.
So this may be a path for us to go like a lead that we can follow over here because it will be looked
in the home user folder first.
So if we create overwrite that as H file in the home user folder, then it will be executed as root
over here and we can understand that it will be executed as a current job.
And maybe we should try to understand then it's going to be executed so that we can write a script to
become root and we can just write a reversal or something like that in order to become root by using
this lead.
Right.
So it's a good practice for us.
But again, there are a lot of other information over here that we didn't cover and we should covered
that in order to understand how current jobs work.
So over here, we see a lot of stars and they actually indicate then this is going to be executed.
The.
Or in which period this is going to be executed?
OK, is it daily, is it weekly, is it monthly?
So we have a lot of stars over here.
So what do all of those things mean?
We have to understand how to read these columns over here.
I have to read this like a table.
So for the first column, we have minutes, OK?
And the second one is the hour.
So a sense for our.
So this is day of month, day of month.
So this is the month itself and this one is day of week.
OK, so these numbers indicate when it's going to be executed.
So if we see stories like this, it means every minute.
OK, and if we see a specific number over here, it indicates the minute, for example, in this case,
17 minutes.
So we're going to just deep dive into this so that you can understand it in a better way.
So let me show you a very quick way to do that.
I'm just going to search for crosstab guru, quantum dot guru.
So this is a website, OK?
And this is not the only Web site that you can see this, but this is a very good one.
So if you cannot make it run, you can just search for other Web sites as well.
But let me show you what I mean.
If you just write the stars over here or if you write the numbers over here, it will just give you
what it means.
So if you see five stars, it means at every minute.
So overwrite S.H. and these compress that S.H. will get executed every minute.
So if we write 17 here, for example, it will be executed at the minute 17.
So every 17 minutes it will be executed.
So if we write 70, 25 over here and six for the next step, it means that it will get executed every
day at six o'clock.
Twenty five past 6:00.
OK, so let's try the other ones.
Of course we have everyone.
I read a script, executed it route over here.
So this will give us some clues.
So this could be four to seven and let's see, four, seven, six.
And the the last one is seven.
So let's see yet at six forty seven on Sundays.
So this is again a very revered current job, but this is how it gets executed.
Right.
So it gets executed every week and it gets executed exactly at six forty seven at some days.
So if we just go over here and make it into 52 and one and start so six, 52 on day of month first.
OK, so this is how you understand when it's going to be executed.
This is very important because maybe you can find a very good vulnerability over here.
Maybe you can just run a script, OK, and it will be executed as route.
But if it's not every minute or if it's not every day, maybe you will have to wait for a month in order
to get that RUCHA.
And it's not very practical.
Right.
So in this case we know that overate S.H. and compress that.
I say you will get executed like every minute.
So if we can overwrite them then it will be great because we will just wait for a minute and we can
get the child back.
So again, this is the current map, so don't forget to go for the cat at second tab when you try to
find the locate the grown ups in your pants.
So what I'm going to do, of course, I'm going to create a home.
Right, S.H., I'm going to echo up being Basche to Tampoe Bash and put a semicolon over here.
I'm just going to give and Sue I.D. to TMB Bash over there.
Since it's going to be executed as root, it will be possible.
And then I'm going to just put this into home user override that.
S.H. So far, so good.
OK, so we have done this before, but I'm going to also make it executable.
Since I created that file as a user, I can just make it executable as user as well.
OK, so great.
Now, since I put this in the home user folder and since I know that home user is the first.
I think that it should be looking in the path, then I can just wait for a minute and become route right,
because it will be executed every minute.
So now it exists over here.
So whatever we can do over here, what we can do right now is just to just go for the top bash like
this, OK?
And if it got executed, then we're going to get the route.
So make sure you put the dash over here like we have done before and hit enter or just wait a minute
and hit enter to see if you can become route, because if it got executed, then we will spawn this
shell.
So let me run the Lesli to Tempe, Basche or Tempe over here.
Yeah, we see the Basche.
Yeah.
Here you go.
We see the Basche.
I got copied over here.
That's how we can actually understand if it got executed or not.
So if I run this.
Here you go.
I got the badge and if I run who I am I, I am route as usual.
Good.
Right.
So let's stop here and continue within the next lecture.