Hi, within this lecture, we're going to see another technique that we can use in order to escalate
our privileges in Linux, and we're going to see this in another machine because it's relatively newly
discovered, I discovered in 2019 and a lot of Linux servers around the world didn't actually upgrade
themselves in order to pass the security over here.
So let me show you what I mean.
I'm going to go into the activities one more time, and this is a free machine as well.
And I didn't even created or I didn't even upload it.
We were just going to take leverage off somebody else's machine on this thingy.
And I believe there more than once.
But I will show you at least the most popular machine or at least what I liked most, because they laid
out the theory as well in a very good way.
So we are looking for seewhy 2019 and 40 to actually fourteen twenty eight and seven like this.
OK, one four two eight seven.
So as you can see, there is only one machine right now and I believe I have seen some others as well.
Maybe it was in the hacked the box, but let me show you what it does.
So I'm going to search for this online.
And of course you will find it in Explode or any other C.V tracking Web sites over here.
So let me just open a couple of these over there so that you can see how it's discovered and what are
the technical things behind it.
So I believe this is the Debian Web site.
So let me come over here.
Yep, it's been discovered in Debian and it says that it's related to pseudo commend itself.
OK, attacker with access to RAM, as also your account can bypass certain policy blacklists.
And I'm going to show you how it's done, how it's how it can be possible to bypass that security.
OK, and over here, you don't have to do that by now.
But by the way, I'm just showing you some kind of details or how you can find it online.
But actually, if you can find this machine, don't try hack me.
They laid out the theory behind it in a very good way.
OK, so make sure you join the room over here and just deploy the machine, OK?
And then you can just try to read the task over there.
And for the first task task, it's just for deploying.
We already know how it's done because we have sold our own machine in the tri hack me and for the task
to secure, to bypass, I'm just going to say OK to this, OK, and go into the task to to read about
the details over here.
So as you can see, this is a vulnerability found in the unique pseudo.
So pseudo is a command in Unix that allows you to execute programs as other users.
We already knew that.
Right.
But what we didn't know or what we actually were learning here is that we can try to act like another
user and we can try to just give the UID of the user, OK, so we can run this command pseudo Danciu
and just give the uid of that user.
So maybe you did know that, maybe you didn't know that.
It's not very important because we can use the user names in the Linux as well.
But it got really important when a certain guy figured out something.
If you just come over here and you know, the route always has the idea of zero.
So we knew that because we actually seen it in the same jewed, said UID code zencey.
So over here it says that route is always zero.
So you can try to become route like pseudo dash you hashtag zero and try to run the command.
And of course it won't work, OK, because there is a security configuration there that it will not
let you run this.
But what if what if you just put a minus zero over there?
OK, so some guy discovered that if you put a minus zero rather than zero over here, minus one, I
mean not minus zero, minus zero vs. well rather than zero, if you put minus one over there, then
it becomes like confused and it actually bypasses that secret, the conflict and it gets executed as
root.
So let me add sensation to this.
Think, OK, the username and password is try hech me.
OK, I'm going to S.H. into this.
And I'm going to say yes, and we're going to try this, so the password should be try hech me and here
you go, we are inside of to try help me if we run.
Unless I lay, nothing is over here.
We don't need any kind of thing or folder or file in order to crack this.
So what I'm going to do, I'm going to run this OK.
So I'm going to run pseudo that's you and give you the zero over here in order to try and execute this
as root.
So I'm going to execute this as being Basche.
It will ask me for a password.
I'm going to give it a try hack me password and here you go.
It doesn't accept it.
Let me try it one more time.
Yeah.
Even though it accepts it, it will say that the user tricked me is not allowed to execute beaten back
shares route on to the privacy of course.
But if I do this like mine is to let me see.
Yeah.
It says that I have no name ok.
But if we execute this like yeah.
It cannot find that id ok if we're on who am I.
But if we execute this like let me exit and execute this as minus one and here you go.
Now we are rude.
So it's actually koshetz in the rules for some reason.
And the reason is that we actually managed to bypass the security by running minus one over here.
So let me get the texte over there so that we can actually copy this selection and put it in the try
me to gain a little bit ranking.
Right.
So you can just do this on your own as well.
So what comment are you allowed to run with?
Pseudo.
Yeah, bash.
We have run bimbette.
Right.
So yeah.
Perico correct answer.
So again, this is a very actually easy vulnerability to just use in order to escalate your privilege,
but also very creative one to discovery.
So congratulations on this guy or whoever discovered it.
And again, don't forget to try this because it's relatively new and you can actually see this in real
life, Pantex as well.
So let me stop you continue it in the next section.