Hi, within this lecture, we're going to see what is an issue wide.
So far we have been working with the school kids and we have leverage that permission in order to gain
a privileged escalation or escalate that privilege in the previous case that we have sold during this
course.
But as I said before, we're going to see in much more detail right now.
So I said, don't worry about this.
We're going to see whether there's later on and we're going to deep dive in the privacy escalation section.
So the time comes.
OK, now we're going to see it.
So I'm going to search for as you did in Google, OK?
And you can just select any of the tutorials over here.
And you don't have to do that by by now.
I'm just showing you a tutorial so that you can see that you can find it anywhere in the Internet.
OK, so as you can see, said only user ID or S uid.
OK, so it stands for set on the user ID is a special type of file permissions given to a file.
OK, so it's basically this special type of file permission.
So and normally when a Linux program runs, it inherits access permissions from the logged in user.
So UID is defined as giving temporary permissions to a user to run a program with the permissions of
the file owner.
So what does this mean when you create a file or when you just put on a binary or some kind of executable?
You can choose who gets to write it, who gets to read it and who gets to execute it in Linux.
So of course, if your route you can just read, write or execute anything you want in the system,
you can just give the special type of permission to yourselves or you can make it available to a single
group or you can make it available to a single user as well.
Right now, we're going to see how it works.
So my IP address is this.
And I'm going to say into it, of course, during this course recordings, I have to close this down
and open it one more time.
So that's the case.
I'm going to log in, as usual, OK?
And I'm going to clear this up.
So here you go.
Right now, I believe we are in the file permissions, which is task 13 over here, but you don't have
to follow it from there.
It's just there for not taking reasons.
So if I run L.A., I can see a lot of information, which is very valuable to us, I think, because
we can see whether it's a directory or file over here.
So D stands for the directory.
OK, if you see a dash it's file.
So over here we can see the permissions.
OK, so the last part this is the highlighted part over here stands for the user and the first one is
the owner.
OK, and the second one second, third bit is the group.
So owner group and the user.
So over here we see who created that file.
Who does that file belong to?
So this file belongs to Root.
As you can see, this directory, I mean, belongs to root and we can see all of those things in Al-Saleh.
OK, so this stands for read, right?
Execute.
OK, so this is a directory.
This is a file.
OK, so this file is created by user and user has given reads, write permissions, not execute permissions
for bashe story.
Of course it doesn't make sense to give execute permissions for a single file like that.
But again, in this case for example, we see it has the read write execute X stands for execute over
here.
So the group user group can read but not write but also execute.
And the all the old users over here can read, not write but execute over here.
OK, so we can specify which user can do something with a file like it, can read it if it can write
it or if it can execute it.
For example, maybe you have seen this before.
You can run mode plus X in order to make a file executable, OK, so that you can just write more plus
s in order to give solid.
Her mission, so over here, we don't see any issue IDs right now, but I'm going to show you, don't
worry about it.
If we see an S over there in the permissions settings, then it means that an assisted permission is
given to us.
So this may lead us to execute a file or just do something with a file, with a route privilege or with
an administrator privilege so that we can take leverage off that.
So I'm going to find some files over here.
And we have seen this comment before.
I'm going to search for a file types and for the permissions.
I'm going to search for oh four oh oh oh OK.
I'm going to go for Alice over here and I'm going to write the output in Dev.
Now, you have seen this comment before, but I, I actually recommend to take note of this because
you will actually need this in real Pantazis.
So over here we see the S because these are the stupid's.
OK, so as it stands for the issue, permission permissions.
So this is kind of a special temporary permission that has been given to us.
So what does it mean?
We get to use those binaries and it happens so that a lot of these files are actually binaries.
And as you IDs are given generally to binaries.
Not necessarily, but it doesn't make sense to give some kind of a text or string file unless you had
permission.
And over here we have a lot of executables like Change Shell, pseudo, pseudo edit password and so
many others as well.
So having this permission isn't a vulnerability, isn't necessarily vulnerability.
OK, but over here we have a suite as oh, this is a shared object and this is obviously put over here
for some kind of CTF purposes.
So maybe we can just leverage this and escalate our privilege.
Where are you going?
To see how it works.
But over here, what is important is that you run this command and you see what kind of permissions
do you have for acid's and you take a look at every executable that you see if you find one that belongs
to root.
And in this case, it belongs to root for every possible scenario over here and try to find a way to
escalate your privilege.
So it doesn't necessarily mean that you're going to escalate your privilege using chain shell, for
example.
But maybe it will be possible by using any of this like this.
Sweet as over here.
OK, so you now know what is in this UID and how to search for it.
And now we're going to see how to actually become route using the vulnerable binaries over here.
So in this case, it belongs to root, as you can see.
And for the group, we have the staff over here.
I don't know what it means.
So we're going to see if we can actually take leverage off that.
So this is, again, one of the most important commands that you should take note of.
If you see something like this in the CTF or repentance, that's the way that you should go.
So I'm going to stop here and continue within the next lecture.