Hi, within this section, we're going to try and escalate our privilege to become rude.
Right now we are robots and I'm just going to run you name a OK, so we are on Ubuntu and I'm just going
to get the Etsy issue here as well to see if we have any kind of information over there.
And as you can see, we don't have that kind of information over here, but we know the Linux version
over here.
So we are in three point thirteen point on Ubuntu.
So maybe there is a kernel exploit over there, but I'm going to go for another direction.
So I'm just going to go for a tutorial like we have done before because we already know that, OK,
it's worth a shot to see if we have anything like we can run like an administrator user.
So if we want to the it will ask us for the password of the robot.
And we know that.
Right.
So let me come over here.
We have taken a note for that.
So not Stotsky.
And I'm just going to copy and paste the password and see if we can find something over here.
So I'm just going to paste it and hit enter.
So here you go.
It doesn't work.
So let me try and just run to the URL and no, let me just pastis and hit enter.
Maybe I'm copying.
It's wrong.
So it says that three incorrect password attempts even though it's not right.
Right.
We managed to log in here.
Yeah.
I believe we copied the wrong thing.
So I'm going to do that one more time.
Come over here and just copy this thing one more time and make sure you copy it right.
And come back and just run the same thing over here if we cannot pasted.
So let me paste a clipboard.
Yep.
If a basically partite works.
So I'm going around to dial one more time and this time I'm just going to paste a clipboard and hit
enter and here you go.
So user robot may not run pseudo on Linux, so we cannot even run pseudo dash out.
But it doesn't mean that we are going to get our we're not going to get to run anything is super administrator
users per user.
So I'm going to run a finite command over here, which will be a comment that you're going to need for
the rest of your life if you're going to be a pen tester.
And this is not the command, by the way, I hit enter by mistake on an accident.
So I'm just going to show you one more time.
So if I run this like that, it will find the every file and folder over here on the server.
OK, we will see something like permission denied and we will see something like that, the permissions
available for us.
So we cannot find we cannot actually go and take a look at those files.
And this is not going to do us good.
But I'm going to show you the correct command.
As you can see, we cannot even see the things over here.
We cannot even see the whole list.
So I'm going to show you a much better way to run that command.
And this is not what I had intended to do in the first place as well.
So I'm going to run a faint comment again.
But this time I'm going to be very specific.
So I'm going to say fine slash.
So I'm searching for the files inside of the whole server over here, not in the current directory.
And we're going to find a command that has a specific permissions set.
And let me just show you the command from my notes over here.
So this is the thing that we are looking for.
So we are trying to find binaries that have the as uid set.
So we have seen this before in the bendat.
So this is actually going to give us the files that has been given for like has been given a special
permission by administrator user so that we can actually run this as as if we are an administrator and
this is supposed to be a temporary or maybe some kind of like a bypass solution for the administrators.
OK, but if it exists, if we can find something that is going to give us leverage of running this as
an administrator and getting back a route shall, then we are going to use it.
And again, this set UID thing.
Is big and bright, but by this time, I suggest you take a note of this comment and I will show you
another comment in a second, take all all of that as well.
But in the privileged escalation section, we're going to deep dive into this and understand the stupid
logic and how it's done and what happens in the background as well.
OK, so just make sure that taken note of this and it will give us the files that we can actually run.
And these files belong to Ruth User or some kind of administrator user.
And if this doesn't work, you can always run the comment like this as well.
So this is kind of finding the permissions and the output of this is going to go into the dev now,
which is nothing.
So it's going into the nulls.
OK, so now means empty.
Nothing, nada voit.
OK, so this is what we're going to do, make sure you copy.
These are just supposed to read your rights on your own and just write it over there and I'm just going
to hit enter.
And as you can see right now, this is much more shorter than what we have seen over here.
As you can see, we only get a couple of things over there.
So these are the comments.
These are the files.
These are the binaries.
OK, executables that we can execute.
And if we can make it work, if we can find that binary, that will give us the leverage of becoming
a root, then it's going to be really good.
Of course, there is a possibility that we get a lot of things over here, but none of them will serve
the purpose of becoming root.
But it's worth a shot to see what kind of things that we have here and try to find our way to become
root.
For example, right now I can see that I can run the password.
Komander user being password comment.
OK, changing the password won't make me root.
So we have changed Shell, which is c, h, S.H. We have pseudo, we have N map which is weird and we're
going to take a look at that.
And we have this tingay going on over here like SSL key sign VM where user acidy wrappers.
So maybe we can take a look at those two.
But SSL key is just for signing your key.
Maybe if it was S.H., then we can we could have done something with it.
But this is only for signing key in order to create like I parameter tingay to log in to the SSA servers.
So over here we have decrypt get device.
I don't know what it does, OK, but we have N map and I believe we can find something to do with the
map and it's very easy to search for the binaries and see if we can actually use them to become root.
So let me come over here and run and map help in my own terminal, in my own colonics and see if we
can find something even remotely related to a privileged escalation.
And of course, if we cannot find it over here.
OK, let me run this one more time with scrapping the shuttle, for example.
Nope, there is nothing over there.
Let me run terminal.
There is nothing over there.
I'm trying to find something that will lead me to execute a comment as root as an administrator user.
OK, I cannot find it.
So I'm just going to open the Firefox, OK, I'm going to close this down and I'm going to open the
Firefox and I'm going to go to Google dot com and I will just run this search for this and map comment.
OK, terminal, something like this.
I want to run a comment using an map.
So if we can do this then we can execute the comment as if we are route, then we can get a child back
as a route.
So let me find this.
Let me try to find it so tough.
Fifteen, a map command.
That's not the thing that we are looking for.
Command line options, maybe.
Let me come over here and just search for an interactive show, something like this.
Maybe this will give us more clues.
On this one, yeah, executed Chalco commence, yep, that's exactly what I'm looking for, so go for
this gatefold Beenz.
So GTR phobias, Yaphet, it can be used to break out from restricted environments by spawning an interactive
shell.
That is exactly what I'm looking for.
OK, so all I have to do is just run and not interactive and run exclamation mark.
S.H. apparently.
Let me try that.
So I'm going to and not interactive like this.
So we are inside of that, OK, and I'm just going to run exclamation mark as H so here we are, we
are in and I say Shell red me around, who am I.
And Hiria we are route that worked because it has a special permission and map has a special permission
and map has assisted suicide.
Permission has been given to us.
It has been given to us.
So we have to search for it.
We have to look deep for it in order to find it, as you can see.
And this works in real life scenarios, OK, because it happens all the time.
Administrators give you idea access to regular users or some kind of developer users all the time so
that if you can leverage that, then it's OK and you can't even find it by Googling it.
It's no big deal.
So let me just locate the tree.
Let me just locate how should we run this?
The long run.
See the route.
Yeah.
Here you go.
See Tree of Tree.
So let me just cut key tree of tree over here and here you go.
We got the final flag over there, so that's great.
As you can see, we managed to complete this CTF.
And again, if you got confused for this set you thingy or if you got confused for finding alternatives
like COL exploits or any other ways of exploiting or just finding someone new abilities to become root,
then don't worry.
As I said before, we're going to take a deep dive into that in a couple of sections.
We're just going to have a section for Linux privilege escalation and the section for Windows privileges
escalation as well, because they are very much different.
But here we took the advantage of set asides as you and we found map can be run as route and we executed
some commands using that leverage.
And here we are.
We are route.
OK, so Mr. Robot is kind of like maybe intermediate kind of thing.
So if you have a previous cybersecurity experience, I believe you understood everything that has been
going on over there.
So, again, if you got confused at some point, don't worry.
We're going to see how it works in the following sections.
Now, we're going to stop here.
And don't forget to take a note of that in map interactive thing as well.
It may come in handy in the following sections or in your real life examples as well.
So we're going to stop here and continue within the next section together.