Hi, within this lecture, we're going to see the details of the Enumerations section that we have done,
and previously I've mentioned that a lot of people actually store their passwords on the passwords are
text files and also maybe without knowing they actually log their passwords in the system.
So we're going to try and see what we can do with that and make sure you're logged in with user.
OK, not rude because we previously became rude.
So make sure you choose to user or just access into the system one more time.
So we have seen that we can actually take leverage of historical command or we can search for the passwords
with defined command or locate commands previously.
So let me run SLA.
As you can see, we have some kind of bad history over here so we can try to see what kind of things
that have been executed on this show.
And we can get this out or we can run history in order to see it in a more clear way.
So let me first cap this out.
So I'm going to the back story over here and here.
We see the history that has been logged in this show.
So over here, if we came over to the top of this historic thing, we can see a lot of comments have
been executed by previously logged in users.
And we can find even some passwords over here if we look carefully.
For example, in this case, my sequel has been executed and over here it has been executed with user
route and for the password password one, two, three has been given.
And for the purpose of this cause, I've changed the password to James one to three, as you might remember,
by if I had to change it, then we could have just used a password one, two, three to become root.
So this may not be that easy, but again, it's worth a shot.
And you can check the BASHE story any time in order to find clues at these clues.
Maybe not the password itself, but some clues to give you privileged escalation ideas in that case.
OK, so maybe you cannot see the bad history file over there, but of course, you care history in order
to see in a more clear way.
Actually, as you can see right now, we get the line numbers over here.
So 30, 30, second line, first line, second line so we can see it in a more clear way.
So it's very easy shot just around history.
Once you become user, you hack into the server and just search for clues over there.
We can find some passwords or we can try to find the passwords or locate the passwords, as we have
seen before.
So maybe you know how to run find.
But I'm going to show you another way of executing this as well in a much more complex way and in a
much more sophisticated way.
So if you if a user actually logs the password in a system or in the lock file, maybe we can grab that
and we can actually use that as well.
So maybe you may want to take a note of this comment as well.
So I'm going to run find help.
As you can see, there are a lot of parameters over here and we have seen, I believe, many of them,
but we haven't actually run this execute thingy or some other things as well.
So let me show you what I mean.
I'm going to run this fine and we're searching for the type F and for the execution.
I'm going to grab some things over here, OK?
And forward the parameters.
I'm going to write I password with curly braces over here.
OK, open and close like we have seen in the documentation.
I'm going to show you one more time.
Don't worry about it.
But after that, after we run this, we can just put the output into that final as well.
OK, so taking note of this comment and make sure you put a backspace back curly back slash at the end
of this line and put a semicolon over here.
Now, if it hit, enter.
Let's see what it does.
As you can see, we get this password three to one.
I actually change this to be James, three to one as well.
But anyway, and it's logged in in the config file for some reason.
And as you can see, we gathered it.
OK, so again, find comment has some other uses over here as well.
So you.
This curly brace notation and make sure you just take taken all of this so that you can actually find
the passwords like that, we have seen the password one, two, three in the history, but we haven't
seen the other one.
Right.
So maybe this would be helpful for you in a real life scenario as well.
So anyway, as you can see, we're doing enumeration and all this information that we gather might lead
us to privacy escalation.
Of course, we can try to do much more stuff in here, but don't forget to run fine.
Don't forget to find history.
Don't forget to run to see if you have bashe story logged in here as well.
So if we run Al-Saleh on ETSI Password, this is one way to check to see if we can read the ETSI passwords.
And over here we can see that we have read privilege for every user over here so we can easily check
this out to check, to see.
And we have talked about this a little bit, but I want to get into details right now and then we're
going to later on during this section, we're going to see how we can actually hack the password by
using the shadow file as well.
So this part is for every user, as you might already know.
So we have the read permission over here not to write or execute permission.
But again, we don't need right.
Permission in order to view the ATSE password.
So if you see there are over there done, it's OK.
Just run cat etsi password like this and you can see all the users and some bashes are like some shells
and some other information like groups over here as well.
So let's see what it does in this case.
We have a lot of information like we have the user name over here root.
OK, so you're wearing the ETSI password as usual.
And as I said before, it used to contain the passwords here in this case.
But right now we only see an X in the place of the password.
So we see the users over here, OK.
And so this is the user and this is the password of the user.
But we don't see the password in the ATSE password.
So where is the password located?
It's located under the Nazi shadow, as I said before.
So right now, the Linux actually moved the passwords to another file and we cannot see them over here.
If we can actually get that shadowfax with using some kind of method, I don't know yet, then we can
actually just combine them together and find the passwords.
If you're on the list, are they on that C shadow?
As you can see, we don't have that right permission over here, so we cannot even see the content of
that C shadow.
If we were root, of course, we would have seen it.
But right now, if you're on Cat, it's the shadow.
You will get permission denied over there.
If you can find something to give you that like a binary set uid binary for cat or something like that,
maybe you can see the content of the ATSE shadow, then you can get the password for the root Arab password
for the other users as well.
But in that case we're not seeing it.
And it's mainly it's actually a most probably what you're going to see in the real CTF or real Pentax
because no one forgets to just delete the permission for aready information or just it's comes in a
default way like that.
So no one gives you permission to see shadow to every user.
But again, it's worth a shot.
So later on during this section, we're going to see how we can actually see that C shadow and how to
combine them together to get the root password over here as well.
But these are all for enumeration purposes.
So make sure you kept that C password and just see that C shadow if it works or not again.
So here you go.
We're going to stop here.
And within the next six years, we're going to explore some other ways of privilege, escalation as
well.