Hi, within this lecture, we're going to explore the kernel exploits.
So these are the most common ways of privilege, escalation that you will encounter during RCTs or real
pentathletes.
So in order to understand is we're going to do a lot of practice and we're going to see some different
tools that you can use in this case.
So I'm going to go into the tools folder that we have over here.
And as I said before, we're going to avoid using these tools in this current section.
But again, you should know how to use them in order to understand usage, in order to actually leverage
these tools if your environment is supporting them.
So if you can download some tools, if you can use Vignette, for example, then it's a very good way
to explore this kernel exploits.
We're going to talk about the kernel exploits.
Don't worry about it.
So I'm going to go into the topic folder and I'm going to try to download something to see if we can
actually do that.
So let me try to Google dot com and see if we can get an Internet connection over here.
As you can see, it seems that it starts pinging, but I'm not very sure about this, OK?
It seems like it starts pinging this thing, but it doesn't actually get a response back.
So I don't know if we can connect to the Internet or not.
So, for example, we can just stop this with control, see, and we can come over here and try to find
some exploit suggests that we can use.
So I'm going to share those things with you.
And there is a tool called Lenn in them.
So it stands for Olympic's and Numeration and Lenn piece.
And there is a VIN piece as well for Windows Privilege Escalations Adjuster.
OK, so this Linux privilege escalates, escalations register and the lint in them is actually very
strong.
And also the Linux exploits register as well.
So there are a lot of tools that you can leverage over here.
So search for Lin and them and just find this, OK?
So this is under reboot user and you can just gather dust leedham that S.H. in order to run it and try
to find the kernel exploits over here again, I'm going to show you what is a kernel exploit.
Don't worry about it yet.
For example, you can even copy and paste this thing if you want, but you can, of course, copy the
link over here and try to download it that we get.
OK, so if you run this, as you can see, I believe we're connecting to that Web site.
Let's see if we can download it really.
OK, and if we can, very good that if we cannot, then we cannot use this.
Maybe we can try to copy and paste, as I said before, or maybe we can use the Linux exploit suggested.
That comes with the tool that comes with the box itself.
But again, this is not working.
This doesn't seem to be working in this case because we cannot connect to the Internet.
So this is this can be the case in many penetration tests that you actually take part.
And again, if you cannot download it, then you should know what to do.
Right.
So that's why we are focusing on the manual side of things.
That's why we are not only seeing the automated things over here.
So I'm going to control Sead of this and I'm going to go over to my user directory over here.
So let me just go to home, sorry.
And we can go into the user directory and just say let's and let's go into tools and let's use this
Linux exploit suggested, for example.
So pretend that you were able to download this and you were able to get the best script over here.
Or you may just try to copy and paste the thing that you can just now it and just create it yourself.
You can just change it to executable by running C.H. Mod seven seven seven on that file.
Right.
So if I execute this, OK, if I execute this S.H., then it will give me some result back.
So what are those results?
So this is exactly what other tools do as well, maybe the more comprehensive way.
But again, over here we have a lot of explicit suggestions.
So these are kernel exploits.
So our Linux has a kernel and.
You might already know and this colonel might be vulnerable to some privileged escalation attacks,
and if we can leverage that, then we can become route or we can become more privileged in a way so
that we can complete our task.
And as you can see in our case, we get a lot of different explicit suggestions over here.
So Dirty Cow is actually one of the most popular ones.
And dirty cow, too, as well.
And it doesn't mean that these are all going to succeed.
Even though we get a lot of suggestions over here.
Maybe some of them will work, maybe some of them won't.
But it's our duty to actually try and see if they've worked or not.
So this engine through that S.H. is a lot of popular.
It has a lot of popularity here as well.
OK, but anyway, in any case, we can try to just leverage them all one by one.
OK, so these are all vulnerabilities that is or that may be related to our Linux version.
So if you're Pentax, if your target server doesn't have the most updated version, which they currently
are, which they hardly ever do, you can try to just go to the guitar page or of one of the exploit
suggestions like this and download the exploit itself and try to use it.
So in this case, I'm trying to download the dirty cow itself.
OK, it gives us a C code.
So I'm just going to close this one because I want to show you the page itself.
So let me try to find the page itself.
Let me go to Google and search for dirty cow exploit.
OK, and here you go.
This is a Linux kernel exploit.
So in the exploit database, we can see the actual code itself.
So maybe you don't know.
See, maybe you don't understand all of this.
It really doesn't matter.
As you can see, there is a C code over here that takes leverage off that vulnerability and try to escalate
the privilege by running some code.
It's OK that you don't understand it, but you should understand how to execute this on your own server,
OK, because if you find an exploit, if you find an actual possible exploit like dirty cow or any other
exploits that we have seen in that list, then you should go to exploit DBI and try to download the
code and execute it yourselves.
And again, maybe it won't be possible for you to download the whole code by running.
We get maybe you can just copy and paste and if you're a psycho, you can just write it by looking over
here on your own to your target system as well.
But again, if you can find a way to download it, it would be much more faster for you.
So theoretically, we have found a possible vulnerability over here.
I mean, we are trying to exploit it by executing some code and we are getting this code from the exploit
database itself.
So let me just come back over here, OK, to our suggestions.
Again, you can try all other ones here as well.
And again, this Linux exploits register is a very good tool that you can actually use in your own Panthers.
You can try to use all other exploits over here.
I'm showing you the dirty cow because it's one of the most popular ones.
So if you run, you name a you can try to search for this exact version over here on Google in order
to understand if there's any vulnerability related to that rather than Linux exploits register.
It's like this.
OK, as you can see, it's already been searched within the Google for a lot of times.
And then we search it.
We can directly go to the article that we have found before.
So if you cannot reach clinics, exploits Algester in a real life example, then it won't matter a lot
because you can actually find it online as well.
OK, so this is the logic behind it.
If you can reach the automated tools, then it's very good that you can get the exact results.
But if you cannot, again, you know how to run.
You name a you.
Now you know how to get the current version of the Linux that you are in so that you can search for
it in an expert DB or any other database as well.
So in this case, we're going to try dirty cow to see if this works or.
And I believe these are the same things over here.
So, again, there are a lot of quotes over there.
I'm not going to go over them.
Maybe you don't even know how to write Seeb, but we can try to download this tool and use it in our
own actually tools in our own server over here.
And for convenience, again, I place the dirty cow over here.
So you can just into that.
Anyone else to see that?
See.
So this is the file that has been given to us.
Again, if you can we get it, then it's OK.
Maybe you can get on it.
Then again, it's OK.
Maybe you can copy and paste it.
It's OK.
Just make sure that you have the tool available in your target server.
So this is a C file.
OK, first of all, we make to make we need to make sure that we can execute it so we cannot actually
run the codes by just typing the C codes.
OK, we need to convert that.
So if you go to GCG over here, you can just search for Jack online, you can see the dirty cow use.
OK, so first of all, we need to actually convert this into an executable using a tool called GCSE.
So this GCSE actually takes in the C codes and gives an output, OK?
And it used some parameters like Petrella parameters can actually change from exploit to exploit and
you can see how to use them in their respective GitHub sites or in exploit DB as well.
So in this case, as you can see, we are using examples for 32 bit and 64 bit.
So I'm going to go for over here DCC call that C and this O is with zero, I believe.
So over here we're going to use BITRATE again and we need an output file to just give an output, an
executable of the C file.
So I'm going to call this dirty cow.
Obviously, you can call this anything you want.
In this case, I just called a dirty cow, as you can see.
Let's check to see if we can execute this or maybe we should run more 777 on that.
Let's check and see.
Here you go.
We can execute this.
And as you can see, it says that dirty cow root for the privilege escalation backing up.
So it's trying to back up some kind of password file into a temporary folder.
And we're going to wait until it's finished.
It may take time.
It may take a little bit of time over here.
So make sure you wait until it's completed.
And I believe I have used this before.
If it doesn't complete within a minute or something like that, we can try to exit out of this one.
But I'm going to wait and see, OK, it shouldn't take more than one minute or something like that.
Meanwhile, make sure you understand what we are doing over here, OK?
We have just selected Dirty Cal as a test.
Maybe it will work, maybe it won't.
We have a lot of suggestions over here and we can just use any of them.
And here you go.
I believe now it's completed again.
If it takes more than one minute, maybe you can try to control see over there somewhere, run password
over here.
And once I run password, as you can see, I became root so and I actually lost the connection for some
reason.
I don't know why we lost the connection.
Let's see.
Let's come over here and here you go.
We have lost the connection because my virtual machine expired over there.
So I should have added one more hour over here, but I believe we missed that opportunity over there.
So it is not related to the experts think that we have done.
I believe I should have told that a long ago and added that one hour before.
OK, but maybe you have seen that we route we were actually route in that case.
So I'm going to do this one more time so that you can see it in a better way.
And you can see it's not related to our previous escalation process, but it's related to be reelecting
me, being reluctant to add one more hour over here in a given period of time.
OK, so I'm going to copy the IP address as far as we can see it over here.
Let's wait until it's shown to us and then we're going to get the IP address over there.
Here you go.
Now it's ten ten one thirty one 37.
So I'm going to switch into that.
OK, our IP address has been changed.
We know that it's user, so it's user at something like that.
Let me try to post a clipboard and say yes and give the password so you know the password.
If you can't remember the password, you can always look for the room over there.
So I'm going to go into tools and run KDA dirty cow.
And here you go.
It doesn't seem to be persistent over here.
Of course, we terminated the machine and now we can see our files.
But again, it's not important.
It's even more practice for us, so it's better.
So we're going to have to use one more time in order to create our own executable over here.
So remember the comment, we need to run.
And just give the cow that C over here as an input and we need to specify the P tread over here.
And for the output, I'm going to call this dirty cow one more time.
So after it's been generated for us, I'm going to run the dairy cow.
So it will take a minute.
Then, as you can see, it says that it's trying to do something with the password over here.
So once we execute the password comment user being password tool, actually, then it will make us root.
And how do I know that?
Of course I get it from the Exploit DB or from the GitHub.
It actually shows you how to run the tool and how to become root after it's been executed.
So it's different for every suggestion, if it's different for every tool that you have seen in the
Linux exploits suggested tool.
So you need to check the GitHub pages or you need to check the exploit DB pages in order to understand
how different tools work by dirty cow generally works.
OK, and that's why I'm showing you this first.
It's also common in the CTF as well as well as a real pentathletes.
So if you think that everybody keeps their Linux system updated, then you are wrong.
Of course they do not.
And this is one of the most common things that you will encounter in real life as well, as I said before.
And also that is one of the reasons why people actually keep their passwords in files, closed files
called password data.
That's why we are trying to locate the passwords or find the password that the files again.
So here you go.
I believe we can do some internal controls.
He over here.
Let's see if we can actually do that.
Yeah, here you go.
Once we run password, it became now via route.
If I run it now, we can see we are route over here.
If I run, where am I?
We are route one more time.
So we managed to get this flack or we managed to become route in some way.
OK, so this was the first task in the section we have seen the colonel exploits.
Now you can go to user by running through user anytime you want, because once you become rude, you
can just switch between the users like that.
And for some reason, clear doesn't work, but it's no big deal.
Again, we're going to see a lot, much more than kernel exploits, but be aware that this is one of
the most common ones.
So check for kernel exploits with Linux exploits register or by doing manual search in Google by looking
at the you name a output.
So see you in the next lecture for continuation of this privilege escalation techniques.