Hi, within this lecture, we're going to see Aldy preload, vulnerability and how to exploit it to
become rude.
Right now, we are in the tech gates.
You can actually follow this along with there as well.
So all you got to do is just run through the shell, as usual.
And we see a lot of binaries over here.
But also we see this thing over here as well.
So helda preload.
Right now, we have access to Aldy preload, so what does it mean once we try to execute any of these
binaries over here?
If we want, we can actually preload some kind of library or some kind of code to execute this before
the original binary order.
So maybe we want to do that in Linux or maybe we don't want to do that.
If we are rude, of course, we have access to this, but even though we are not through this, permission
is given to us.
So if you see Aldy preload over here in the CTF or in a Pantusso, it means that you get to load a library
before executing any of the commands or any of the binaries over here.
So not depending on the binary that you execute, it will work.
Whatever you write, whatever you actually supply here will work.
So whether it's Panchita, whether it's anything else, it will work.
OK, so of course you're going to have to try and see if this works or not.
But again, in this case, we're going to do that.
So in order to do this, we need to understand the C code over here.
So I have shared the C code with you.
So this is kind of a very small exploit that you're going to write.
You can reach this from here anytime you want.
But also I'm going to write it down here in order to preload this before executing any of the binaries
over there.
OK, so I'm going to show you how it's done as well.
But first of all, we need a C code.
So, again, anytime you can come back here and just write this so you don't have to take a note or
something like that, but it's very simple.
And all you got to do is just type this out.
So I'm going to show you don't worry.
So first of all, we are user and we see the Aldy preload is permitted.
So what I'm going to do, I'm going to write the C code over here and just use this comment in order
to create a shared object, which is kind of a executable but not really.
OK, so this is kind of a ready to compile thingy and we can just use this to preload the shared object
over here before executing any binary.
So I'm going to use Nano.
Of course, you can use anything you want.
I'm going to call this library Dot C and over here I'm going to write test, for example, and let's
see if we can actually see the library that.
See, here you go.
Now we can see it now.
I'm going to narrow this thing one more time.
So it means that we get to actually write some stuff in the user folder.
If we cannot do that, we can try this in under DTMF folder, obviously.
OK, so I'm going to delete this and come over here and start typing with me.
So I'm going to bring in the standard libraries for so I'm going to write hash tag include and standard
input output over here.
OK, dot h like that.
And we also need one more thing.
So I'm going to say include OK sis types that h so these are the libraries that we will need and also
don't forget to just standard library that over here.
OK, so here you go.
Now we, we have all we need over there, so bring in all of those things so that your code works,
OK.
So after that we are just importing the libraries that we need in order to make this run like in Python.
And remember Python, I'm going to create a method over here which will start with void.
So void means null, nada, nil, OK, it will return nothing.
So this will get executed, but it will just return nothing.
And I'm going to call this in it.
And this will be the first thing that should get executed once we write this.
OK, so let me do this over here.
Don't forget that the curly braces over there.
After that, I'm going to just bring four spaces over here and write you unset environment onsets Aneth.
And over here you need to specify the Aldy preload over here, OK?
So like this.
So it has to be exact.
So follow along with me again, bring in one tap, so just leave a space of one tab like four four spaces
over here and then just write the rest of the code.
So what we do here is actually valid for the other codes as well.
Other than preload, all you got to do is just write set jaideep, which is group ID over here, OK,
and just make it zero which is root.
So I'm going to hit one more time and tab if tap doesn't work, just bring in the spaces and just run
citywide id.
This is user idea, I'm going to make it root as well.
So finally I'm going to come over here and just write system and call the bean bag or age depending
on the situation over here.
And don't forget the semicolon.
So that's it.
Actually, all we are doing over here is setting the group idea end user ID to zero and spawning the
Basche, spawning the shell so it will make us root and it will spawn a child for us.
OK, so this is a standard C code other than preload, you can use this in other cases as well.
So I'm going to say this with control or enter and hit control x to get out of this one.
Now, Library C is over there.
OK, now Library C contains the exploit code, so I'm going to use the jack over here.
So make sure you type the exact parameters I'm doing and this parameters can be retrieved from the tri
hack me again.
So you got to do shared.
Oh and after that this stands for the output and I'm going to save this under TMP and I'm going to name
this like library that is OK.
And so stands for the shared object that I've talked about.
And finally, you have to specify the library that C with no start files like that.
So make sure you take a note of these parameters.
And even if you don't, you can get this from the trajectory.
Me, as I said before.
So basically we're compiling this into a shared object as a file so that we can actually run a pseudo
Ali preload and make it equal to the shared object file that we have created.
And in order to do that, all you got to do is just say equals sign and make it into the path that we
have supplied, like TMP Library that as o like this.
OK, so of course if we didn't have this pseudo permission over here for the Aldy preload, then it
wouldn't work.
But right now we have some specified for unmap.
OK, and if I run with my now as you can see I am root over here.
You see it is specified exactly like this for a patch to and that's it.
So you can try it with unmap, you can try it with the battuta or any other binary that you see in that
list and it will get executed.
All it's doing over here is said JID, said Eweida and spawning the Basche.
So make sure you remembered that it it is not mandatory for you to know about.
See, I haven't written a project in C for years right now, but again, it's very easy once you know
any programming language.
So make sure you got this.
Once you exit out of this one, we are using one more time and we're going to continue with the previous
escalation within the next lecture.