1
00:00:01,040 --> 00:00:03,040
All right, we're back live.

2
00:00:03,100 --> 00:00:09,880
And thank you, Tyler, for supporting DEF CON, supporting the community, supporting the Red Team Village, in order to have you here.

3
00:00:10,040 --> 00:00:12,940
And with that said, without any further ado, take it away.

4
00:00:13,640 --> 00:00:16,780
Hey, good evening, late night DEF CON.

5
00:00:16,780 --> 00:00:18,440
This is 50 Shades of Pseudo-Abuse.

6
00:00:18,440 --> 00:00:21,100
I'm Tyler Boykin, and this will be my talk.

7
00:00:24,080 --> 00:00:26,620
So, we'll do a quick about.

8
00:00:27,040 --> 00:00:31,560
And the intended audience level for this kind of thing is beginner to intermediate.

9
00:00:31,560 --> 00:00:34,980
And there's plenty of talks on some whiz, some cool advanced stuff.

10
00:00:34,980 --> 00:00:39,740
But I figured we'd keep it in the beginner-intermediate range.

11
00:00:39,740 --> 00:00:44,640
Or if you're a more seasoned professional, you may pick up a few things, maybe a good refresher.

12
00:00:44,720 --> 00:00:53,560
We'll do a brief crash course on Pseudo, on where it stands on the TTP, the MITRE realm of things.

13
00:00:53,560 --> 00:00:55,860
And then we'll cover the Pseudovers file.

14
00:00:55,860 --> 00:00:59,360
And then we'll hit up some enumeration and recon.

15
00:00:59,840 --> 00:01:03,260
And then we'll go into the fun stuff, which are all the examples.

16
00:01:04,720 --> 00:01:07,200
So, a little bit about me.

17
00:01:07,200 --> 00:01:10,500
I'm an Aggie communications officer with the Marine Corps.

18
00:01:10,880 --> 00:01:14,300
Cut my teeth with network engineering and information assurance.

19
00:01:14,300 --> 00:01:18,460
And then now I do security engineering for BioLite Professional IT Services.

20
00:01:18,700 --> 00:01:22,000
And so you can find me on Twitter and a few other places.

21
00:01:23,120 --> 00:01:31,220
Okay, so superuserdo, whether you're calling it pseudo or sudo, we're talking about the same thing.

22
00:01:31,640 --> 00:01:39,640
And it's basically, it allows any permitted user to execute commands as another intended user.

23
00:01:39,640 --> 00:01:43,880
Typically, 90% of the time, it's going to be approved.

24
00:01:44,360 --> 00:01:55,180
And the security policy, which is what we'll dive into as we're going into this, determines what privileges, what allocations, what all can that user do.

25
00:01:57,420 --> 00:02:11,820
And the whereupon authentication, specific tokens are made on the pseudo tracks, each and every failed or successful authentication.

26
00:02:12,000 --> 00:02:17,200
And it'll remember you for five minutes, so if you ever notice that, and then so on.

27
00:02:18,480 --> 00:02:29,980
And so when you execute a command, and you'll see this later on too, unlike su, as you were, the security policy just states which environment you get.

28
00:02:29,980 --> 00:02:35,940
So whenever you are actually running sudo, you inherit all of that users in full environmental variables.

29
00:02:35,940 --> 00:02:41,520
For instance, you get the, unless it's explicitly stated otherwise.

30
00:02:41,520 --> 00:02:43,820
So you typically get their environment variables.

31
00:02:43,820 --> 00:02:47,740
You'll get a variety of IDs, right?

32
00:02:47,740 --> 00:02:51,340
And unless you specify otherwise.

33
00:02:51,540 --> 00:02:55,080
Real effective user IDs, group IDs, right?

34
00:02:55,080 --> 00:02:58,700
You get a good variety of things up there.

35
00:02:58,700 --> 00:03:00,800
But it's as the target user.

36
00:03:02,820 --> 00:03:05,920
And these are straight out of the sudo man pages.

37
00:03:05,920 --> 00:03:11,940
I'm just going inch deep, mile wide stuff, just to kind of give a little bit of a background.

38
00:03:11,940 --> 00:03:15,020
There is no easy way, right?

39
00:03:15,020 --> 00:03:17,000
There is no easy way.

40
00:03:17,060 --> 00:03:28,240
And this is to prevent a malicious user from escalating, abusing stuff if stuff is allocated.

41
00:03:28,240 --> 00:03:32,140
Simply because there's a whole breadth of things.

42
00:03:32,300 --> 00:03:39,480
There's this breadth of applications and features that can be manipulated maliciously.

43
00:03:39,480 --> 00:03:42,620
It gets rather hard.

44
00:03:42,840 --> 00:03:46,000
And so, I mean, there are ways to mitigate this.

45
00:03:46,000 --> 00:03:54,980
You force, at least you really crank down on the least privileged kind of method of security and whatnot.

46
00:03:54,980 --> 00:03:59,880
But it's really, you have to be particularly stingent when allocating stuff.

47
00:04:00,480 --> 00:04:04,640
Okay, so we'll kind of shift gears here into Mitre.

48
00:04:05,100 --> 00:04:09,000
And so it falls under abuse elevation control.

49
00:04:09,000 --> 00:04:11,340
So this shouldn't be anything new, right?

50
00:04:11,340 --> 00:04:17,580
This is pretty similar vernacular to what we've been talking about the past couple of minutes.

51
00:04:18,140 --> 00:04:25,880
Adversaries may circumvent mechanisms designed to control and elevate privileges to higher level and so on.

52
00:04:25,880 --> 00:04:34,040
And so where the sudo and the sudoers falls into is now the new format, which they went to sub-techniques.

53
00:04:34,220 --> 00:04:37,020
And I'll give you all a quick minute to read that.

54
00:04:37,020 --> 00:04:38,460
I think I've got it.

55
00:04:38,880 --> 00:04:40,260
No, I'm just kidding.

56
00:04:40,860 --> 00:04:44,080
So basically it says the same thing.

57
00:04:44,120 --> 00:04:51,460
Adversaries may perform sudo caching, and that's to where they go after those token files.

58
00:04:52,060 --> 00:04:58,800
And so in the directory, each user that attempts to authenticate via sudo gets their own specific directory.

59
00:04:59,180 --> 00:05:02,380
And then each attempt has its own little file.

60
00:05:02,380 --> 00:05:03,400
It's kind of cool.

61
00:05:03,400 --> 00:05:14,940
And then adversaries may attempt to abuse the caching or misconfigurations in sudoers, and that is where you'll actually wind up seeing

62
00:05:18,600 --> 00:05:23,620
a lot of the stuff for all this talk are mostly out of sudoers misconfigurations.

63
00:05:25,400 --> 00:05:28,320
Okay, and that's a good segue.

64
00:05:28,320 --> 00:05:35,240
So sudoers is the primary configuration file when you're working with sudo.

65
00:05:36,200 --> 00:05:38,360
It resides in Etsy.

66
00:05:38,620 --> 00:05:42,880
Technically, you can edit it with whatever you want to.

67
00:05:42,880 --> 00:05:47,820
That is not encouraged because it is very syntax picky.

68
00:05:47,920 --> 00:05:52,320
So generally speaking, you make a copy of it and you use visudo.

69
00:05:52,800 --> 00:06:01,440
And if you use visudo to edit the file, it'll run the error checking, the syntax checking immediately upon exit.

70
00:06:01,460 --> 00:06:07,940
Or you can just, let's say, if you wanted to tweak something, mess with something, you can always just run the standalone checker on the file.

71
00:06:15,270 --> 00:06:17,650
So that's what it's basically going to look like.

72
00:06:17,650 --> 00:06:19,150
You're going to have...

73
00:06:21,450 --> 00:06:25,470
If you make a misconfiguration anywhere in sudoers, it'll yell at you.

74
00:06:25,470 --> 00:06:27,250
Like that.

75
00:06:27,310 --> 00:06:31,250
And then if you're good, then it tells you, okay.

76
00:06:34,030 --> 00:06:39,970
So the sudoers specifies the who, what, when, where.

77
00:06:40,030 --> 00:06:41,670
It's the be-all, end-all.

78
00:06:41,670 --> 00:06:46,130
Other documents contribute to this whole security order, this whole policy.

79
00:06:46,130 --> 00:06:52,270
But the main point of configuration is sudoers.

80
00:06:52,270 --> 00:07:00,170
And so unlike... by default, password authentication is required, but you can specify no password.

81
00:07:00,310 --> 00:07:07,350
But unlike su, where you authenticate as the user which you are trying to do stuff as, so let's say root.

82
00:07:07,350 --> 00:07:10,190
You authenticate as root.

83
00:07:10,230 --> 00:07:16,350
Sudo, using sudoers, you authenticate as the user calling it.

84
00:07:16,350 --> 00:07:19,450
And so it's a little bit less.

85
00:07:20,710 --> 00:07:23,850
And so the file is composed of two main parts.

86
00:07:23,850 --> 00:07:25,970
It has some other sections, too.

87
00:07:27,890 --> 00:07:30,950
And you can go into a little bit more detail about that.

88
00:07:30,950 --> 00:07:38,030
But for the purposes of what we're doing here, you're going to have your aliases, which are kind of like variables and placeholders.

89
00:07:38,610 --> 00:07:45,070
And then you have your userspecs, which are the five Ws.

90
00:07:45,090 --> 00:07:47,990
And there's quite a few userspecs for these examples.

91
00:07:50,010 --> 00:07:55,370
And so when multiple entries stack up, they're applied in order.

92
00:07:55,510 --> 00:07:57,270
You see that a lot in userspecs.

93
00:07:57,270 --> 00:08:01,310
And then if there's... and then it racks and stacks into the last one.

94
00:08:08,320 --> 00:08:10,000
So, aliases.

95
00:08:10,120 --> 00:08:13,920
The interesting thing is that these syntax on the man pages are actually a little less...

96
00:08:13,920 --> 00:08:17,940
When you see them in a sudoers file, it kind of makes sense because stuff, right?

97
00:08:17,940 --> 00:08:20,020
But the format kind of eh.

98
00:08:20,020 --> 00:08:22,400
But essentially, it's alias type.

99
00:08:22,400 --> 00:08:23,660
Name.

100
00:08:23,660 --> 00:08:26,740
And then you go on and you can specify whatever you're trying to alias.

101
00:08:26,740 --> 00:08:30,080
And then you have your defaults that you can always set to.

102
00:08:31,720 --> 00:08:34,200
And so, moving on a little bit.

103
00:08:34,200 --> 00:08:39,820
The sudo allows for shell-style globs and wildcards.

104
00:08:39,900 --> 00:08:47,520
It's not actual regex, but if you've ever done anything in bash or shell or whatever, it's similar in functionality.

105
00:08:47,840 --> 00:08:51,360
An asterisk is one or more.

106
00:08:52,020 --> 00:08:55,000
And then question mark is any single character.

107
00:08:55,300 --> 00:09:01,900
You can kind of do range, kind of splitting between brackets and so on.

108
00:09:01,900 --> 00:09:07,400
But this isn't... it's not actual regex, but it functions similar to what you see in bash or any kind of shell.

109
00:09:09,840 --> 00:09:12,680
Okay, so we're down to the user specs.

110
00:09:12,920 --> 00:09:16,480
And this is actually a little bit more of the intuitive part, in my opinion.

111
00:09:16,540 --> 00:09:19,160
Because it basically... it's the who, what, when, where.

112
00:09:19,160 --> 00:09:20,720
You have the who, where.

113
00:09:20,720 --> 00:09:23,640
In the parentheses, you have the as whom.

114
00:09:23,700 --> 00:09:31,920
And you can use colons to delineate further detail into that.

115
00:09:31,940 --> 00:09:33,140
And then the what.

116
00:09:33,140 --> 00:09:39,880
And then sandwiched between the what are tag specs that kind of throw stipulations on some of the activities on how it's done.

117
00:09:39,880 --> 00:09:42,720
And we'll go into that with the next slide or two.

118
00:09:42,720 --> 00:09:45,700
And so the run as spec.

119
00:09:45,700 --> 00:09:48,000
So, for example, me at server.

120
00:09:48,240 --> 00:09:50,840
Me at host server.

121
00:09:51,100 --> 00:09:53,880
You know, as operator, these commands.

122
00:09:54,440 --> 00:09:55,780
It's not to the web.

123
00:09:57,280 --> 00:10:00,100
And so tag spec, and this is what I was talking about earlier.

124
00:10:00,100 --> 00:10:04,500
It sandwiches in between the as whom and the command part, right?

125
00:10:04,700 --> 00:10:13,860
And this can either greatly, drastically make a red teamer's life easier or it can make it a little bit more difficult, make it more complicated.

126
00:10:14,420 --> 00:10:18,280
No password, you'll see sometimes.

127
00:10:18,960 --> 00:10:25,220
Set in will also, you can deliberately manipulate the environment when you're calling those commands.

128
00:10:25,220 --> 00:10:32,460
And no exec prevents dynamically linked applications from actually calling shell on themselves.

129
00:10:32,460 --> 00:10:34,920
Or running commands themselves, you know.

130
00:10:34,920 --> 00:10:38,720
And we have an example of that later on also.

131
00:10:38,720 --> 00:10:41,760
But I'm going to hope for that no password.

132
00:10:42,160 --> 00:10:43,440
So much easier.

133
00:10:44,160 --> 00:10:46,880
Okay, so enumeration.

134
00:10:49,400 --> 00:10:50,960
So there's manually, right?

135
00:10:50,960 --> 00:10:52,300
You have sudo l.

136
00:10:54,080 --> 00:10:59,920
And if you're lucky, and this could be for any kind of real-world pen testing, CTFs.

137
00:10:59,920 --> 00:11:02,160
Could be for any type of thing, right?

138
00:11:02,320 --> 00:11:03,720
You have sudo l.

139
00:11:03,860 --> 00:11:05,480
And it might be as easy as that.

140
00:11:05,480 --> 00:11:08,000
The user that you may have compromised may be a sudoers.

141
00:11:08,000 --> 00:11:15,560
And when you do sudo l, you may get a listing of every, you know, what all that user can do, right?

142
00:11:15,560 --> 00:11:17,500
You have etcdoers.

143
00:11:18,380 --> 00:11:20,400
It should, hopefully it exists.

144
00:11:20,660 --> 00:11:25,260
If you can read it as an unprivileged user, I think there are bigger things going on.

145
00:11:25,260 --> 00:11:27,700
Or you're in a CTF, you know.

146
00:11:27,700 --> 00:11:32,560
But, I mean, that would help you help enumerate and get a bigger picture of things.

147
00:11:32,800 --> 00:11:37,100
In the event that you cannot, for instance, let's say you can't do sudo.

148
00:11:37,100 --> 00:11:40,200
But you're still trying to look at version numbers or whatever else.

149
00:11:40,200 --> 00:11:45,360
You can still get the version number from sudo with capital V and just do some googling.

150
00:11:45,700 --> 00:11:49,020
You know, maybe you can find a user or service that can't use sudo.

151
00:11:49,020 --> 00:11:52,140
And then you may be able to leverage that for exploitation.

152
00:11:53,080 --> 00:11:54,280
Etsy group.

153
00:11:54,280 --> 00:11:55,840
And so, same thing.

154
00:11:55,840 --> 00:11:59,860
You can see additional users that may be in, you know, the sudoers group.

155
00:11:59,960 --> 00:12:06,400
And then one of the places it logs is to var log or auth log.

156
00:12:06,400 --> 00:12:09,420
And so, that's all manual stuff.

157
00:12:10,340 --> 00:12:16,380
And generally speaking, because this is a subset of privileged escalation.

158
00:12:16,380 --> 00:12:22,540
So you don't need as much expansive tools and resources to really enumerate what you have, per se.

159
00:12:22,540 --> 00:12:25,180
You know, let's say if you're doing some other things.

160
00:12:25,260 --> 00:12:26,860
But there are automated things.

161
00:12:26,860 --> 00:12:30,420
For MSF, you know, you have post modules.

162
00:12:30,800 --> 00:12:32,840
I think the interpreter has a few also.

163
00:12:32,840 --> 00:12:35,500
And then there's some pretty well-known scripts, too.

164
00:12:35,500 --> 00:12:36,700
Like linenum.

165
00:12:36,720 --> 00:12:41,920
Anybody who's done CTLs and some other things has used linenum.

166
00:12:41,920 --> 00:12:43,940
That's a pretty well-known one.

167
00:12:44,040 --> 00:12:46,520
Follow sudo is actually pretty neat also.

168
00:12:46,520 --> 00:12:52,080
And I make another reference to the creators of that.

169
00:12:52,100 --> 00:12:56,540
And that particular one in the middle references that for that particular CVE.

170
00:12:57,400 --> 00:13:04,520
Okay, so examples.

171
00:13:05,360 --> 00:13:09,480
So this is from the creator, follow sudo.

172
00:13:09,480 --> 00:13:15,160
And this is more the degree of examples.

173
00:13:15,160 --> 00:13:17,900
Because it's kind of a spectrum.

174
00:13:17,900 --> 00:13:22,800
And I like to use the fruit, the hanging fruit kind of analogies.

175
00:13:22,800 --> 00:13:27,440
So the two examples, a complete lack of configuration.

176
00:13:28,000 --> 00:13:30,180
It's nothing wide open.

177
00:13:30,180 --> 00:13:31,680
It's low hanging fruit.

178
00:13:32,020 --> 00:13:33,360
That's the lowest hanging fruit.

179
00:13:33,360 --> 00:13:35,480
And you should go for the lowest hanging fruit first.

180
00:13:35,480 --> 00:13:37,140
Because those are the beginnings.

181
00:13:37,480 --> 00:13:39,120
Or you might see...

182
00:13:39,860 --> 00:13:43,600
They've tried to configure secure sets of rules.

183
00:13:43,600 --> 00:13:47,120
But there may be a bug in one of the applications.

184
00:13:47,420 --> 00:13:48,780
It may be something flagged.

185
00:13:48,780 --> 00:13:50,120
Or they just didn't know.

186
00:13:50,240 --> 00:13:52,300
But they're trying.

187
00:13:52,300 --> 00:13:57,840
Or it just may not be configured consistently throughout whatever they're doing.

188
00:13:58,180 --> 00:13:58,640
Right?

189
00:13:58,860 --> 00:14:05,740
Which is actually pretty normal for any other kind of real system hardening and whatnot.

190
00:14:06,420 --> 00:14:07,600
And you get the lowest of the fruit.

191
00:14:07,600 --> 00:14:08,820
You get the open sudo.

192
00:14:08,860 --> 00:14:12,860
And then you've got the top part, which is the fairly secure, as he's mentioning.

193
00:14:12,940 --> 00:14:17,800
But for today's purposes, we're going to be mostly residing mostly in the middle.

194
00:14:17,800 --> 00:14:19,420
You'll have a little bit of low fruit.

195
00:14:19,420 --> 00:14:22,500
And we'll have a little bit of the cool stuff up at the top.

196
00:14:22,500 --> 00:14:24,300
But the middle is going to be...

197
00:14:24,300 --> 00:14:25,620
That's where the fun playground is.

198
00:14:25,620 --> 00:14:28,880
Because it's a little bit gamier, in my opinion.

199
00:14:30,480 --> 00:14:31,200
Okay.

200
00:14:31,420 --> 00:14:36,520
So when you're doing this, you want to get creative and inventive.

201
00:14:36,520 --> 00:14:45,280
Because you don't necessarily have to get a fancy CVE, per se, with these.

202
00:14:45,280 --> 00:14:54,180
You don't have to make an alphanumeric fricking rock chain or anything like that.

203
00:14:54,180 --> 00:14:56,900
You're just using what exists creatively.

204
00:14:56,900 --> 00:14:58,560
And so that's kind of the cool part about it.

205
00:14:58,560 --> 00:15:00,800
And can you read something off limits?

206
00:15:00,800 --> 00:15:02,140
Can you write to something?

207
00:15:02,140 --> 00:15:06,160
If you can write to something, then you can go really far then.

208
00:15:06,300 --> 00:15:06,800
Right ?

209
00:15:08,900 --> 00:15:11,700
This is where you're scouring the man pages.

210
00:15:11,700 --> 00:15:14,700
And you're looking for flags.

211
00:15:14,700 --> 00:15:17,500
You're looking for little subtle things that may be kind of useful.

212
00:15:17,500 --> 00:15:19,900
And that's why it's more fun.

213
00:15:20,360 --> 00:15:23,760
And it's kind of a misnomer, escalate laterally.

214
00:15:23,760 --> 00:15:25,440
You may be able to move laterally.

215
00:15:25,440 --> 00:15:32,540
I haven't really seen any non-root users specify in sudoers.

216
00:15:32,540 --> 00:15:33,460
But that's an option.

217
00:15:33,460 --> 00:15:35,460
You can do sudo as a different user.

218
00:15:36,980 --> 00:15:40,420
But using that gets you to a different user.

219
00:15:40,420 --> 00:15:43,940
I mean, that's worth mentioning on a pin test report.

220
00:15:43,940 --> 00:15:46,500
And that may get you to something bigger and better.

221
00:15:46,500 --> 00:15:48,540
It's not always about up and down.

222
00:15:48,540 --> 00:15:50,040
Sideways works too.

223
00:15:50,260 --> 00:15:50,860
Right ?

224
00:15:52,060 --> 00:15:58,360
And so with that, we are now entering low-hanging fruit.

225
00:15:58,900 --> 00:16:00,840
So this is the easy stuff.

226
00:16:00,840 --> 00:16:03,260
Open sudo, the classic example.

227
00:16:03,260 --> 00:16:08,320
Wide open, user authenticates as himself, his or herself, whatever.

228
00:16:08,320 --> 00:16:12,060
And then the system is their oyster.

229
00:16:12,060 --> 00:16:15,100
Their one step, their keystrokes away from root.

230
00:16:16,160 --> 00:16:18,780
And so you go into a little bit more.

231
00:16:19,200 --> 00:16:30,120
So these, any applications that directly result in a shell, they're pretty much right next to there.

232
00:16:30,220 --> 00:16:34,080
This is your SH, KSH, ZSH, whatever, right?

233
00:16:34,080 --> 00:16:35,200
SU.

234
00:16:35,200 --> 00:16:42,080
And any actual programming languages too, because those can, again, cough up shells.

235
00:16:42,420 --> 00:16:44,760
Cough up shells, cough up functionality.

236
00:16:46,260 --> 00:16:48,780
Those are pretty big gummies.

237
00:16:51,060 --> 00:16:54,280
And so then we go, this is kind of like a little bit higher.

238
00:16:54,280 --> 00:16:59,220
We're turning up the volume on the creativity a little bit, right?

239
00:16:59,220 --> 00:17:04,340
And so you've got commands, right?

240
00:17:05,180 --> 00:17:11,640
And so you're not, they don't give you, they can give you instant shells, but it's not right off the bat.

241
00:17:11,640 --> 00:17:13,540
So you've got to dig for stuff a little bit.

242
00:17:13,540 --> 00:17:15,080
And you have to use stuff unintended.

243
00:17:15,620 --> 00:17:17,780
You've got to think outside the box.

244
00:17:18,200 --> 00:17:21,580
And so that's why I think, that's why I kind of like some of these.

245
00:17:22,100 --> 00:17:23,620
And so here are a few examples.

246
00:17:23,620 --> 00:17:25,680
When you do wget, right, for instance.

247
00:17:25,680 --> 00:17:34,900
If you supply I as an input file, it'll attempt to read each line in that file as its own URL and it'll attempt to shoot it.

248
00:17:34,900 --> 00:17:38,940
So if you do sudo wget whatever, say Etsy shadow, right?

249
00:17:39,060 --> 00:17:44,880
Each line of Etsy shadow is going to be, wget is going to try to resolve or make a request to each line of Etsy shadow.

250
00:17:44,880 --> 00:17:48,540
I mean, it'll fail, but that's file read, right?

251
00:17:48,640 --> 00:17:52,300
You're now reading sensitive files that you're not supposed to.

252
00:17:53,340 --> 00:17:55,160
And same thing with curl.

253
00:17:55,660 --> 00:17:57,420
And this one's actually kind of cool.

254
00:17:57,420 --> 00:18:00,400
These are two web request applications.

255
00:18:00,720 --> 00:18:04,380
And you don't even have to make an actual web request for them, really.

256
00:18:05,220 --> 00:18:06,600
So it's kind of neat.

257
00:18:06,600 --> 00:18:08,240
And so you continue to offset.

258
00:18:08,900 --> 00:18:12,020
And then it'll automatically find where to resume.

259
00:18:12,020 --> 00:18:16,920
And you basically specify the remote name, which is local.

260
00:18:16,920 --> 00:18:18,580
And so then you specify file.

261
00:18:18,580 --> 00:18:31,500
It actually accepts in this format here, file, kind of like you're doing FTP or whatever, or HTTP, the location on the local system.

262
00:18:31,500 --> 00:18:36,760
And it'll download it and you can read it.

263
00:18:36,760 --> 00:18:38,160
It's actually pretty neat.

264
00:18:39,420 --> 00:18:41,800
Base64 is another interesting sample.

265
00:18:41,800 --> 00:18:42,640
That's file read.

266
00:18:42,640 --> 00:18:44,060
I think that's file write also.

267
00:18:44,060 --> 00:18:45,280
I'll have to double check.

268
00:18:45,280 --> 00:18:50,100
But essentially, you're looking at, it's file read.

269
00:18:50,100 --> 00:18:54,480
And if you pipe it into itself and supply the D flag, you have the clear text.

270
00:18:54,560 --> 00:18:56,320
You have it on 64.

271
00:18:57,600 --> 00:19:06,520
And then GCC, if you supply wrappers, it'll run the command that you supply.

272
00:19:06,520 --> 00:19:12,560
And all params are passed comma separated after the initial command.

273
00:19:14,020 --> 00:19:17,020
And then at the very end, we're tagging along.

274
00:19:17,020 --> 00:19:22,140
Let's say you have kind of a bug or like a big, gaping kind of bug thing.

275
00:19:22,460 --> 00:19:29,810
And it's kind of a mix between the high level and low level.

276
00:19:30,120 --> 00:19:36,480
But any bugs that are incurred at sudo are going to have sudo consequences also.

277
00:19:36,480 --> 00:19:42,120
So, where's my demo thing?

278
00:19:42,120 --> 00:19:42,780
Okay.

279
00:19:42,900 --> 00:19:47,820
So, we will do some shell time.

280
00:19:47,820 --> 00:19:48,800
How about this?

281
00:19:49,180 --> 00:19:53,240
So, L, section one, open sudo.

282
00:19:53,240 --> 00:19:56,000
So, yeah, sudo L, right?

283
00:19:56,000 --> 00:20:00,780
Anything, you do sudo su cat root text.

284
00:20:00,780 --> 00:20:01,560
That's what it looks like.

285
00:20:01,560 --> 00:20:05,420
That's what I'm using for these particular purposes.

286
00:20:05,420 --> 00:20:08,400
Looks like that kind of jazz, right?

287
00:20:11,260 --> 00:20:17,160
So, apps, sudo L.

288
00:20:17,460 --> 00:20:19,780
And so, this is pretty much the same thing too.

289
00:20:19,800 --> 00:20:23,460
If you run sudo is in the top two, you're going to get an instant shell.

290
00:20:24,080 --> 00:20:31,900
Creatively, I think the kind of neat one and one that you can use for if you're working, trying to get a non-limited shell is with the Python.

291
00:20:31,900 --> 00:20:40,170
And so, Python, most interpreted kind of languages and some things, except inline commands, correct?

292
00:20:40,720 --> 00:20:49,060
So , pity spawn, pity the fool, bash, right?

293
00:20:49,060 --> 00:20:50,360
And so then your root.

294
00:20:51,120 --> 00:20:53,960
It's pretty cut and dry.

295
00:20:54,000 --> 00:20:56,200
It was pretty straightforward.

296
00:20:56,760 --> 00:21:00,940
So, now we're getting into a little bit more fun stuff with wget and whatnot.

297
00:21:02,060 --> 00:21:10,560
So, if you notice, it accepts an input file.

298
00:21:10,560 --> 00:21:16,450
And so, basically, that's what it looks like.

299
00:21:16,450 --> 00:21:20,110
It tried to run the flag in our particular case.

300
00:21:20,490 --> 00:21:25,890
It tried to make a request to it and obviously it's going to fail because it's nothing, right?

301
00:21:26,270 --> 00:21:31,430
And so, that was pretty neat when I first learned that, right?

302
00:21:31,430 --> 00:21:34,990
And so, base64, similar thing.

303
00:21:35,930 --> 00:21:43,830
It comes in as you're basically piping it to itself and you're specifying the D, which means decode.

304
00:21:46,570 --> 00:21:49,710
So, here we go.

305
00:21:51,390 --> 00:21:53,730
Wrapper, we have got root.

306
00:21:54,590 --> 00:21:56,270
It ran sh.

307
00:21:58,090 --> 00:22:02,230
And then, lastly, for this little bit, curl.

308
00:22:02,230 --> 00:22:07,670
So, it literally downloads and the spot into the local directory.

309
00:22:10,110 --> 00:22:11,650
We've got the flag.

310
00:22:12,970 --> 00:22:14,930
Bada bing, bada boom.

311
00:22:15,470 --> 00:22:22,430
And so, in this particular instance, it's just a small program, say, mycat, right?

312
00:22:22,430 --> 00:22:23,730
Just to show an example.

313
00:22:23,730 --> 00:22:35,450
Obviously, and didn't mention this before, but as we progress along, you'll see a common trend of applications having more than one exploitation vector, right?

314
00:22:35,450 --> 00:22:38,210
So, it may not just be file read.

315
00:22:38,210 --> 00:22:39,490
It may can do file write.

316
00:22:39,490 --> 00:22:42,950
It may be able to do commands, right?

317
00:22:42,950 --> 00:22:49,010
It just depends on how you work it and whatnot.

318
00:22:49,010 --> 00:22:57,130
And so, in this particular case, it basically takes in through standard input and sends that to system, right?

319
00:22:57,130 --> 00:23:00,110
So, there's two, at least two with this one.

320
00:23:00,110 --> 00:23:06,630
So , I do sudo mycat, do root text, write file read, sensitive file read.

321
00:23:06,630 --> 00:23:13,930
You can also write bin sh, get root.

322
00:23:13,970 --> 00:23:18,010
Typical string exploitation.

323
00:23:21,890 --> 00:23:23,010
Okay.

324
00:23:24,890 --> 00:23:27,210
Okay, now we're going to get a little bit fun now.

325
00:23:27,210 --> 00:23:28,950
So , pager abuse.

326
00:23:31,510 --> 00:23:33,910
Okay, those got mixed up.

327
00:23:33,910 --> 00:23:35,150
Okay, so pagers.

328
00:23:35,150 --> 00:23:47,410
So, whenever you run man or service or any kind of terminal editor, and those things where you can scroll up, down, left, right, it's called a terminal pager.

329
00:23:47,970 --> 00:23:53,490
And the interesting thing is that people know what it is, but they don't know what it is per se.

330
00:23:53,510 --> 00:23:57,850
But it's basically what happens behind the scenes is a terminal pager gets called.

331
00:23:57,850 --> 00:24:04,710
And they accept extra commands.

332
00:24:04,710 --> 00:24:12,730
When you supply an exclamation mark, anything proceeding that exclamation mark gets run as a command.

333
00:24:14,070 --> 00:24:18,150
So, your editors, you know, vim, nano, etc.

334
00:24:18,610 --> 00:24:21,190
And so, yeah.

335
00:24:21,190 --> 00:24:23,630
We'll go ahead and show that right quick.

336
00:24:23,630 --> 00:24:33,010
Like, l, section2, pagers, if I can type,

337
00:24:36,540 --> 00:24:37,120
l.

338
00:24:37,620 --> 00:24:43,340
So, yeah, if I do sudo man man, quick example, we're now in a terminal pager.

339
00:24:43,580 --> 00:24:45,740
You can go up, down, left, right, whatever.

340
00:24:45,740 --> 00:24:50,380
By simply just typing stuff, it'll start parsing your input.

341
00:24:50,380 --> 00:24:55,580
And by doing exclamation mark, everything after this will be run as a system command.

342
00:24:55,580 --> 00:25:00,360
So, vim sh, we're now root, etc.

343
00:25:02,740 --> 00:25:05,700
Same thing with service, too.

344
00:25:05,700 --> 00:25:10,100
So, sudo service blank status.

345
00:25:10,100 --> 00:25:11,920
I'm going to get all of them.

346
00:25:11,920 --> 00:25:13,860
I'm going to open up a pager.

347
00:25:17,260 --> 00:25:20,760
vim sh, easy peasy.

348
00:25:20,760 --> 00:25:26,200
And so, a neat thing is you tend to forget these types of things.

349
00:25:26,200 --> 00:25:30,280
But let's say you do a service, but it doesn't have that much output.

350
00:25:31,700 --> 00:25:34,360
It's more just kind of terminal fundamentals, perhaps.

351
00:25:34,500 --> 00:25:36,640
Let's say you do cron status, right?

352
00:25:37,600 --> 00:25:41,000
And actually, it does do a pager right there, midway.

353
00:25:41,020 --> 00:25:49,140
But for whatever reason, if the pager ends prematurely, let's say it finishes, you can always just shrink your freaking terminal down to like here.

354
00:25:49,600 --> 00:25:56,040
And then do it again, and it'll open up the pager for you.

355
00:25:56,220 --> 00:25:57,620
So, I think that's kind of neat.

356
00:26:05,820 --> 00:26:08,140
Yes, GTFO bins.

357
00:26:08,140 --> 00:26:09,920
A lot of these are on GTFO bins.

358
00:26:09,920 --> 00:26:13,880
Now, I tried not to just go down and just start listing them off.

359
00:26:13,880 --> 00:26:15,780
I tried to grab a variety of different things.

360
00:26:15,780 --> 00:26:23,040
So, yeah, GTFO bins is definitely very, very handy.

361
00:26:23,040 --> 00:26:27,620
If you're not using that, you're definitely crippling yourself in what you can do.

362
00:26:28,060 --> 00:26:29,480
Okay, cron abuse.

363
00:26:29,620 --> 00:26:31,680
So, this kind of goes without saying.

364
00:26:32,320 --> 00:26:44,760
If you can edit, you can manipulate or run or do any kind of service type things as root, that's going to have root-like implications.

365
00:26:45,620 --> 00:26:50,560
And so, that's a pretty short slide.

366
00:26:51,040 --> 00:26:59,120
But , so, sudo l, or s-u-l, sorry, section 3, cron l.

367
00:27:00,420 --> 00:27:13,880
Yeah, and so in this particular instance, right, and so it's actually worth noting that if you do cron tab, if you haven't done it before in the system, and you don't have the right environmental variables set, what's the first thing it asks you?

368
00:27:13,880 --> 00:27:17,180
It asks you, what editor would you like to use?

369
00:27:18,000 --> 00:27:26,880
And so then you have editor-style exploits with whatever kind of services you can do also.

370
00:27:28,480 --> 00:27:33,060
So, in this particular case, sudo l.

371
00:27:33,280 --> 00:27:48,160
So, let's do sudo cron tab e, and I already have something set up, but now we're in Vim, right, so any kind of root, easy peasy.

372
00:27:48,240 --> 00:27:56,600
But, it's also the implication that you can edit the root's cron tab and run stuff as root, any kind of services.

373
00:27:56,600 --> 00:28:07,720
In this particular case, I have this little script here, and all it does is, just for the example, it basically reads in root text and writes it to the current directory.

374
00:28:07,720 --> 00:28:10,820
It's pretty easy peasy.

375
00:28:10,820 --> 00:28:15,760
So, sudo service cron start.

376
00:28:18,610 --> 00:28:20,550
And you'd have to wait a minute.

377
00:28:20,730 --> 00:28:26,890
And let me see what's going on, on the Discord.

378
00:28:26,950 --> 00:28:27,790
Okay.

379
00:28:28,570 --> 00:28:38,470
So, at some point, probably in a minute, I might not just wait for it, but we'll see root text should hopefully populate up here.

380
00:28:39,810 --> 00:28:42,070
But, I don't think I'll wait for that.

381
00:28:42,630 --> 00:28:44,790
So, you'll just have to deal with it.

382
00:28:45,130 --> 00:28:47,950
Okay, so now we're getting into a little bit more fun stuff.

383
00:28:48,230 --> 00:28:50,030
LDPreload is actually kind of neat.

384
00:28:53,550 --> 00:28:56,970
And you need a bit of a background to understand what's going on.

385
00:28:56,970 --> 00:29:02,190
So, LDPreload, it's an exploit.

386
00:29:02,450 --> 00:29:09,210
You're using a feature that is intended to be used with dynamically linked binaries.

387
00:29:10,350 --> 00:29:19,830
Whereas, all the methods and all the stuff is resolved at runtime, whereas it's statically linked.

388
00:29:19,830 --> 00:29:27,870
You get that bigger file if you statically link everything, but you don't have to worry about shared objects being all messed up and whatever.

389
00:29:27,870 --> 00:29:31,370
You have everything in one nice big package.

390
00:29:32,230 --> 00:29:38,550
But, obviously, with dynamic linking, you do have a smaller file size.

391
00:29:38,550 --> 00:29:45,050
You have your typical libc and a bunch of other things to worry about.

392
00:29:45,050 --> 00:29:48,430
But, overall, it's a little bit more flexible.

393
00:29:49,910 --> 00:30:00,870
And so, with the LDPreload, you can essentially tell it to load that stuff before it loads the other stuff.

394
00:30:00,870 --> 00:30:09,330
And so, you can essentially overwrite any kind of method or function in whatever application you're running.

395
00:30:09,930 --> 00:30:14,310
And so, we need to put a few things together.

396
00:30:14,310 --> 00:30:19,670
You're combining a custom functionality with a binary that's being run as pseudo.

397
00:30:19,890 --> 00:30:22,130
And, obviously, that's going to equal fun.

398
00:30:22,210 --> 00:30:23,790
Pretty fun.

399
00:30:23,790 --> 00:30:26,890
And so, you'll see this in the environment.

400
00:30:27,150 --> 00:30:31,490
Whenever I've seen it, it's been in the environment.

401
00:30:31,650 --> 00:30:34,170
And the binary also has to be compiled for it.

402
00:30:35,350 --> 00:30:52,610
And so, the syntax for when you want to go about business with this, the pseudo LDPreload, you can export it to the env, to your environmental variables, or you can just run it all in one, like how we're about to do here in a minute.

403
00:30:53,650 --> 00:30:56,590
So, demo.

404
00:31:01,740 --> 00:31:06,240
So, L section for LDPreload.

405
00:31:07,880 --> 00:31:12,900
So, in this particular case, we can run the example.

406
00:31:12,900 --> 00:31:16,620
And I tried to cite, I got some of these examples straight off the internet.

407
00:31:16,620 --> 00:31:17,940
I tried to cite them.

408
00:31:17,940 --> 00:31:21,600
You can find these, I'll link to them, so if you want to look at them, reference them too.

409
00:31:22,300 --> 00:31:29,400
So, in this particular case, the example was, it runs a loop, and it prints 10 random numbers.

410
00:31:29,400 --> 00:31:33,700
It calls ran, and it outputs the standard out 10 numbers.

411
00:31:33,820 --> 00:31:46,880
So, in this particular case, because it's a dynamically linked, we can provide our own stuff, and we have the LDPreload environmental variable set.

412
00:31:46,880 --> 00:31:58,900
So, in this particular case, cat drandom, and basically, it's going to overwrite the rand function, and it'll just return 42.

413
00:31:59,120 --> 00:32:03,640
So, example C, right here, right?

414
00:32:03,640 --> 00:32:11,540
And so, you're basically going to, essentially, you're going to make that do what you want it to, which is kind of cool.

415
00:32:11,540 --> 00:32:13,920
So, for this particular example,

416
00:32:24,670 --> 00:32:44,750
So, sudo ldpreload drandom, shared object, to example.

417
00:32:44,750 --> 00:32:49,550
And, as you see, we basically made random do what we want to.

418
00:32:49,550 --> 00:32:50,550
So, it's no longer random.

419
00:32:50,550 --> 00:32:53,930
It just prints 10 42s instead of a bunch of actual random.

420
00:32:54,050 --> 00:32:59,890
So, taking that a step further, oh, we can manipulate the file as sudo.

421
00:33:00,070 --> 00:33:01,650
So, what do we do?

422
00:33:02,190 --> 00:33:04,310
We get evil.

423
00:33:05,550 --> 00:33:09,910
And, in this particular case, we're overwriting init, which happens right off the bat.

424
00:33:11,590 --> 00:33:15,330
And, you know, we basically pop shell.

425
00:33:15,830 --> 00:33:23,470
And so, using a similar type thing, evil, we are now rooted.

426
00:33:23,470 --> 00:33:24,430
It's pretty cool.

427
00:33:24,430 --> 00:33:30,370
And another cool thing is that it'll finish running the rest of the application once we exit.

428
00:33:30,370 --> 00:33:30,970
See?

429
00:33:30,970 --> 00:33:32,790
Because we only overwrote init.

430
00:33:32,790 --> 00:33:34,270
We didn't overwrite the rest of it.

431
00:33:34,270 --> 00:33:35,410
So, it's kind of neat.

432
00:33:36,010 --> 00:33:37,130
Okay.

433
00:33:42,610 --> 00:33:43,170
Okay .

434
00:33:45,090 --> 00:33:46,210
Installers.

435
00:33:46,250 --> 00:33:59,910
So, it goes without saying, right, that installing any kind of application is a security concern, especially if you're going to install it as admin, as root, any kind of privileged accounts, right?

436
00:34:00,150 --> 00:34:05,430
And so, these can definitely be leveraged in various kinds of ways.

437
00:34:05,430 --> 00:34:07,890
Pip, apt-get, dpkg, you name it.

438
00:34:09,330 --> 00:34:14,370
And so, for instance, a lot of these have multiple, let's say, apt-get and dpkg.

439
00:34:14,370 --> 00:34:16,550
They both invoke a pager.

440
00:34:16,790 --> 00:34:21,610
You can do stuff during install, providing custom functionality.

441
00:34:21,950 --> 00:34:28,750
For example, pip, when you're in setup, you can specify entire methods for doing stuff.

442
00:34:28,950 --> 00:34:31,090
It becomes your oyster.

443
00:34:31,090 --> 00:34:39,150
So, obviously, installing things as root is a big, critical security consideration.

444
00:34:40,950 --> 00:34:42,190
Okay.

445
00:34:42,190 --> 00:34:45,470
We will hit that up.

446
00:34:54,470 --> 00:34:58,090
Okay, so, sudo l.

447
00:34:58,970 --> 00:35:03,810
Okay, so, how does one make that a shared object?

448
00:35:05,970 --> 00:35:09,450
You compile and link.

449
00:35:10,110 --> 00:35:14,590
You basically don't do the full process when you compile.

450
00:35:16,210 --> 00:35:21,250
If somebody doesn't share that with you, we can grab that here after this.

451
00:35:22,070 --> 00:35:30,470
But basically, you make it a shared object, and it can be used by other dynamically linked applications.

452
00:35:33,150 --> 00:35:37,630
So, let me grab my thing real quick, y'all.

453
00:35:38,210 --> 00:35:45,050
Okay, so, for the pager, right, pager abuse, sudo apt-get.

454
00:35:45,900 --> 00:35:47,250
Not bad.

455
00:35:49,430 --> 00:35:51,090
Change log.

456
00:35:54,270 --> 00:35:56,990
See, we now have a pager.

457
00:35:57,250 --> 00:36:00,090
So, the old stuff still applies.

458
00:36:00,350 --> 00:36:09,150
And so, having that kind of mentality that, oh yeah, we're in familiar territory, it will help us for later on.

459
00:36:09,150 --> 00:36:16,970
And so, in this example, we have apt-get shell package.

460
00:36:16,970 --> 00:36:23,230
And all it's doing, you're basically providing custom functionality, and it runs at the very end.

461
00:36:23,230 --> 00:36:34,450
So, all you gotta do, you can specify, instead of making a normal web request out, you specify a local file for which to draw from.

462
00:36:34,450 --> 00:36:37,810
And then it basically goes like that.

463
00:36:39,150 --> 00:36:40,190
It's pretty cool.

464
00:36:43,620 --> 00:36:49,820
And the same thing with, when you go to setup, or setup, excuse me, pip.

465
00:36:49,980 --> 00:37:00,420
So , in this particular case, we have a setup py, like what you'd see in any, if you're installing any kind of module, any kind of thing written in Python or whatever, you'll have your setup py.

466
00:37:00,840 --> 00:37:05,340
And in this particular case, it actually does a reverse shell.

467
00:37:05,340 --> 00:37:09,080
And so, I'm gonna use, I need to split screen for a minute.

468
00:37:09,080 --> 00:37:15,150
I think that one was 1, 2, 3, 4, 5.

469
00:37:16,710 --> 00:37:19,210
So, 1, 2, 3, 4, 5.

470
00:37:19,210 --> 00:37:23,910
We do sudo pip install .

471
00:37:23,910 --> 00:37:27,290
to specify from the local directory.

472
00:37:28,290 --> 00:37:29,410
And we do.

473
00:37:30,210 --> 00:37:31,330
And we have.

474
00:37:31,810 --> 00:37:32,870
Bada bing.

475
00:37:33,730 --> 00:37:35,050
Pretty cool.

476
00:37:36,390 --> 00:37:37,050
Exit.

477
00:37:37,050 --> 00:37:38,070
Exit all out.

478
00:37:38,070 --> 00:37:39,250
All that jazz.

479
00:37:39,250 --> 00:37:40,690
Okay.

480
00:37:43,940 --> 00:37:45,280
Right on, right on.

481
00:37:46,860 --> 00:37:49,960
So, path and secure path.

482
00:37:49,960 --> 00:37:59,320
So, these, so if you recall back, right, globs and whatnot are acceptable within the sudoers file.

483
00:37:59,460 --> 00:38:03,960
The asterisk, star, whatever, is what are more?

484
00:38:03,980 --> 00:38:06,140
Question marks, new characters, and so on.

485
00:38:06,140 --> 00:38:12,360
So, and this is kind of in the same family as your normal environmental variable path, right?

486
00:38:12,360 --> 00:38:15,820
It's in the same vein of exploitation.

487
00:38:16,280 --> 00:38:22,840
If you see asterisks, you see stars in the sudoers file, you can have similar consequences, too.

488
00:38:23,160 --> 00:38:27,660
So, it's kind of similar in this particular case.

489
00:38:27,660 --> 00:38:35,320
Not exactly, but for example, if you see a dot, an emf, it's gonna read from the current directory first, wherever it's being invoked, and then it goes on.

490
00:38:36,560 --> 00:38:39,300
It goes on down the line, right?

491
00:38:39,300 --> 00:38:42,820
And if you see an asterisk, that means anything for that directory.

492
00:38:43,240 --> 00:38:45,880
And so, that's what's happening in this particular case.

493
00:38:45,880 --> 00:38:49,420
You know, anything in bin, you know, is free game.

494
00:38:49,620 --> 00:38:52,200
And so, obviously, that's not particularly secure.

495
00:38:52,840 --> 00:38:58,640
And so, interesting enough, for sudoers, right, you have the secure path.

496
00:38:58,640 --> 00:39:10,360
So, if you don't actually trust the environmental variables at the lower level to be well-formed or whatever, or to be secure, you can kind of override that with your own secure path.

497
00:39:10,700 --> 00:39:19,740
But obviously, if the secure path is misconfigured, that's fun for more than one person involved.

498
00:39:20,800 --> 00:39:29,440
So, and in this particular example, we made secure path temp to show that it's kind of a misconfiguration of sorts.

499
00:39:30,720 --> 00:39:36,200
So, l section6 path.

500
00:39:36,200 --> 00:39:39,240
I believe for this one, I'm doing the bin.

501
00:39:39,240 --> 00:39:52,220
So, and it's also worth noting, right, in other kind of privilege escalation mindset, that, you know, I can run anything in this directory.

502
00:39:52,220 --> 00:39:56,480
And so, as sudo, so you can basically write your own shell.

503
00:39:56,480 --> 00:40:00,740
You can do whatever, and it'll run what you want.

504
00:40:00,740 --> 00:40:04,300
So, in this particular case, I just made id, it runs shell.

505
00:40:04,400 --> 00:40:05,880
It's weird, but whatever.

506
00:40:05,880 --> 00:40:14,140
You know, and so, sudo, let me copy all that, I ain't typing that stuff.

507
00:40:14,180 --> 00:40:16,260
Boom, id.

508
00:40:20,900 --> 00:40:24,260
It's pretty intuitive.

509
00:40:24,400 --> 00:40:29,620
And then, sudo l.

510
00:40:29,760 --> 00:40:34,680
So, this particular one, it's going to check temp first.

511
00:40:34,680 --> 00:40:37,120
Because that's a misconfiguration on the secure path.

512
00:40:37,180 --> 00:40:38,040
And it's a particular one.

513
00:40:38,040 --> 00:40:41,260
And there's actually another exploit later on that utilizes double stars.

514
00:40:41,260 --> 00:40:43,300
But this is for the example, this purposes.

515
00:40:43,680 --> 00:40:46,620
You know, where is usually, where is ping usually at?

516
00:40:46,620 --> 00:40:49,140
Ping is usually user bin, right?

517
00:40:49,140 --> 00:40:58,580
But obviously, if we do sudo temp, and ahead of time, it's a temp to ping, right?

518
00:40:58,580 --> 00:41:05,100
You get the flag, because in that particular file, it does the same thing.

519
00:41:05,100 --> 00:41:07,080
It's just reading and printing, right?

520
00:41:08,060 --> 00:41:14,260
And so, that's just insecure path considerations when you're using globs and whatnot.

521
00:41:15,700 --> 00:41:16,440
Okay.

522
00:41:19,630 --> 00:41:23,830
So, we're getting there.

523
00:41:23,830 --> 00:41:24,790
We are getting there.

524
00:41:24,790 --> 00:41:26,210
Okay, so this one's kind of neat.

525
00:41:26,210 --> 00:41:28,330
So, editors and sudo edit.

526
00:41:29,150 --> 00:41:31,710
So, you have your obvious kind of blatant stuff.

527
00:41:31,710 --> 00:41:33,590
You already got your pager and whatnot.

528
00:41:33,590 --> 00:41:38,170
And anything with editors, you have file read, file write, any kind of commands.

529
00:41:38,170 --> 00:41:40,610
But how it does some things are kind of weird, right?

530
00:41:40,610 --> 00:41:48,730
And so, there's a few new things I stumbled upon while I was even making this in the past months.

531
00:41:49,990 --> 00:41:55,510
And we will include an actual CVE with this also, because it's kind of in the same line of things.

532
00:41:56,410 --> 00:41:58,310
And this is the actual CVE.

533
00:41:58,310 --> 00:41:59,910
It's on exploit DB.

534
00:42:01,410 --> 00:42:05,710
Sudo edit does not check the full path.

535
00:42:05,710 --> 00:42:07,150
So, if you use double globs.

536
00:42:07,870 --> 00:42:13,450
And so, the POC for this is you create a send link to anything sensitive, right?

537
00:42:13,470 --> 00:42:19,970
Anything sensitive, and it'll resolve that as correct, and it'll run it.

538
00:42:20,250 --> 00:42:21,630
And you're good.

539
00:42:21,810 --> 00:42:23,030
It's pretty cool.

540
00:42:23,790 --> 00:42:29,510
So, we will get to keyboard mashing.

541
00:42:29,990 --> 00:42:35,570
L, section, 7, editors, clear.

542
00:42:35,570 --> 00:42:37,050
Sudo l.

543
00:42:38,470 --> 00:42:39,530
Okay.

544
00:42:39,530 --> 00:42:41,910
So, we can do that one first.

545
00:42:41,910 --> 00:42:47,090
So, in this particular example, we have two directories.

546
00:42:47,990 --> 00:42:52,870
Test2 with protected, which is the actual symlink to it.

547
00:42:53,650 --> 00:42:56,250
It's going to Etsy Shadow right now.

548
00:42:57,270 --> 00:42:57,970
And then we have...

549
00:42:58,410 --> 00:43:00,850
Let me scooch that up a little bit for us here.

550
00:43:01,330 --> 00:43:02,270
There we go.

551
00:43:02,550 --> 00:43:02,970
All right.

552
00:43:02,970 --> 00:43:04,370
And so, var...

553
00:43:04,370 --> 00:43:06,030
I just made some dirs.

554
00:43:06,030 --> 00:43:06,870
And this one is...

555
00:43:07,510 --> 00:43:08,950
It's actually really nothing.

556
00:43:08,950 --> 00:43:10,690
I think it has some stuff on it.

557
00:43:10,690 --> 00:43:11,950
I forget what I put on there.

558
00:43:12,150 --> 00:43:18,750
But, either way, the user can't access either of them, because it does not have the permissions.

559
00:43:19,350 --> 00:43:19,590
All right.

560
00:43:19,590 --> 00:43:20,050
But...

561
00:43:20,050 --> 00:43:21,590
So, if I were to do...

562
00:43:22,870 --> 00:43:23,590
Sudo...

563
00:43:24,670 --> 00:43:25,990
Sudo edit.

564
00:43:25,990 --> 00:43:26,970
Right.

565
00:43:27,290 --> 00:43:28,590
And then specify...

566
00:43:30,990 --> 00:43:32,870
Test2 protected.

567
00:43:34,310 --> 00:43:35,750
Oops.

568
00:43:38,480 --> 00:43:49,220
So, it is worth noting that if you fat-finger something, you fat-finger it, it will ask you for a password.

569
00:43:49,220 --> 00:44:03,440
So, if you specify no password on a security policy, and whatever you're doing is prompting you for a password, then that action is not covered under the policy, and you're likely not going to be able to do it.

570
00:44:18,290 --> 00:44:19,630
Sudo edit.

571
00:44:27,600 --> 00:44:28,880
There we go.

572
00:44:28,880 --> 00:44:29,380
Okay.

573
00:44:29,380 --> 00:44:32,240
And so, now we are in anti-shadow.

574
00:44:32,880 --> 00:44:34,880
I must have been fat-fingering something.

575
00:44:35,920 --> 00:44:38,880
And so, this next example is actually kind of cool.

576
00:44:39,140 --> 00:44:41,840
So, we have this entry right here.

577
00:44:41,840 --> 00:44:43,000
No password.

578
00:44:43,240 --> 00:44:46,660
So, they're trying to lock us down to them, but they also have no exec.

579
00:44:46,880 --> 00:44:51,220
And so, if we recall what no exec is, it means no shells, or you can't run commands.

580
00:44:51,220 --> 00:44:53,420
You especially can't pop shells, right?

581
00:44:53,500 --> 00:45:01,940
And they are trying to lock us down to where we can only edit this particular file, which doesn't exist, but you can obviously open it.

582
00:45:01,940 --> 00:45:05,780
You can create the file and then save or do whatever in them.

583
00:45:06,300 --> 00:45:09,240
So, and we'll test that theory, right?

584
00:45:09,240 --> 00:45:11,700
Sudo them.

585
00:45:11,700 --> 00:45:14,100
Let's say we want to do root.txt, right?

586
00:45:14,220 --> 00:45:18,000
Can't do it because we're being prompted by password.

587
00:45:18,080 --> 00:45:23,700
Let's say if we use sudo them, and we actually do go to this.

588
00:45:28,470 --> 00:45:29,130
Right.

589
00:45:29,130 --> 00:45:32,350
So, obviously, and if we try to do our typical shenanigans, right?

590
00:45:32,350 --> 00:45:33,890
Nope.

591
00:45:33,990 --> 00:45:34,930
Denied.

592
00:45:34,930 --> 00:45:36,650
No shell for you, right?

593
00:45:36,650 --> 00:45:41,050
It's pretty cool, but here's a neat trick.

594
00:45:41,050 --> 00:45:47,510
You can source externally from within editors to doing your own stuff.

595
00:45:47,510 --> 00:45:51,770
So, colon E for edit, R for write, for read, right?

596
00:45:54,840 --> 00:45:55,920
Exactly.

597
00:45:56,280 --> 00:45:58,080
So, I think that's pretty neat.

598
00:45:58,080 --> 00:46:04,320
And then you can basically kind of wiggle around from inside, kind of like that.

599
00:46:06,120 --> 00:46:06,940
Okay.

600
00:46:07,320 --> 00:46:10,600
We are hooking and jabbing.

601
00:46:10,600 --> 00:46:13,240
We got a couple more, and then we are done-skies.

602
00:46:14,000 --> 00:46:15,140
So, PwFeedback.

603
00:46:15,140 --> 00:46:21,760
This one is an actual, this is also an actual CVE and has an exploit db entry.

604
00:46:22,560 --> 00:46:33,720
So, basically, in older renditions of sudo, it will ask you for your password, but when you supply stuff via standard input, it gives little stars.

605
00:46:34,040 --> 00:46:51,140
And, essentially, there is a stack-based buffer overflow, too much input through standard input, and you supply long enough of a string, you can then put in whatever malicious badness, goodness that you want.

606
00:46:51,140 --> 00:47:00,360
And it's actually a pretty simple exploit, and it's pretty simple to check out.

607
00:47:03,160 --> 00:47:06,060
And we will go ahead and do that.

608
00:47:07,480 --> 00:47:10,420
However, I need to see what user...

609
00:47:10,420 --> 00:47:11,580
One second.

610
00:47:12,380 --> 00:47:16,760
I need to get what I call these, because I don't call them all intuitive names, per se.

611
00:47:17,720 --> 00:47:18,660
Eight.

612
00:47:19,340 --> 00:47:20,560
Oh, that one is.

613
00:47:20,560 --> 00:47:22,120
Okay.

614
00:47:23,880 --> 00:47:26,260
Okay, pwfeedback, right?

615
00:47:26,280 --> 00:47:33,140
So, sudo l, in this particular case, we do need it this time.

616
00:47:33,760 --> 00:47:41,800
We do need it to prompt us for a password, so we can actually exploit, we can smash the stack, basically.

617
00:47:42,860 --> 00:47:48,920
And so, I have two POCs, and then I think once you can find it on...

618
00:47:48,920 --> 00:47:50,820
I think I'll link to at least one of these.

619
00:47:50,820 --> 00:47:52,760
They're pretty self-explanatory.

620
00:47:53,440 --> 00:48:01,140
So, this first one, it's 100 As terminated by a null, and it does this 50 times.

621
00:48:01,480 --> 00:48:08,200
And then after that, you can pipe in whatever commands you want, generally speaking, after the S.

622
00:48:08,200 --> 00:48:22,540
And so, for instance, if I were to do sudo, actually, POC, rear root, right?

623
00:48:22,540 --> 00:48:26,740
And notice in here, we're not actually supplying a password.

624
00:48:26,740 --> 00:48:28,940
It did ask us for a password, right?

625
00:48:28,940 --> 00:48:32,960
So, if we do sudo whatever, it asks us for a password, and we had to supply it.

626
00:48:32,960 --> 00:48:39,660
But because we smashed the stack, basically, and then supplied our own command, that's basically how we went out of business there.

627
00:48:39,660 --> 00:48:41,400
And the same thing with POC2.

628
00:48:42,340 --> 00:48:43,660
It's the same concept.

629
00:48:43,660 --> 00:48:45,200
It's just more fanciness.

630
00:48:45,200 --> 00:48:48,500
In that case, it does a reverse shell, like before.

631
00:48:48,880 --> 00:48:52,240
Okay, we have about 10 minutes left.

632
00:48:52,560 --> 00:48:53,800
I'm going to go ahead and...

633
00:48:53,800 --> 00:48:54,680
Yeah, we can do that one, too.

634
00:48:54,680 --> 00:48:55,420
Why not?

635
00:48:55,940 --> 00:48:56,940
Why not?

636
00:48:56,940 --> 00:48:58,620
Demux.

637
00:49:01,460 --> 00:49:04,500
This one was 3.4.

638
00:49:06,700 --> 00:49:08,460
POC2.

639
00:49:10,000 --> 00:49:11,760
Hmm.

640
00:49:11,760 --> 00:49:13,560
That's curious.

641
00:49:13,700 --> 00:49:15,560
Oh my god.

642
00:49:16,400 --> 00:49:18,800
Well, they all almost worked.

643
00:49:24,550 --> 00:49:25,690
Hmm.

644
00:49:25,750 --> 00:49:27,910
Might have to fuck with that later.

645
00:49:27,910 --> 00:49:30,550
But they'll get the general principle.

646
00:49:38,920 --> 00:49:40,240
Demo gods.

647
00:49:41,380 --> 00:49:41,920
So...

648
00:49:42,700 --> 00:49:43,780
Okay.

649
00:49:44,640 --> 00:49:45,860
Limited shells.

650
00:49:45,860 --> 00:49:47,480
This one's actually pretty neat.

651
00:49:47,480 --> 00:49:50,560
And I learned this, actually, by doing Pentester Academy.

652
00:49:50,920 --> 00:50:00,260
And if you're trying to look for different neat kind of ways to enhance your existing skill set, or learn completely new things, I highly encourage that.

653
00:50:00,260 --> 00:50:07,220
I'm not trying to show for Pentester Academy or BVIC, but he's a great instructor, and they have some great coursework.

654
00:50:07,220 --> 00:50:11,980
And so, in this particular one, just showing this particular example.

655
00:50:12,920 --> 00:50:15,700
And it's kind of a hypothetical, too, right?

656
00:50:15,780 --> 00:50:23,280
So, let's say you have a huge credentials.

657
00:50:23,860 --> 00:50:29,520
Normally, you would be able to do sudo as a user, but you do not have a full TTY.

658
00:50:29,680 --> 00:50:33,020
Let's say, for whatever reason, you can't make a full TTY.

659
00:50:33,020 --> 00:50:39,260
You can't do the SOCAT, the STTYRAW echo trick, all those normal things.

660
00:50:39,260 --> 00:50:40,820
Let's say those aren't working.

661
00:50:40,820 --> 00:50:49,140
But you still have a limited shell, and you have the ability to run sudo, because you can run sudo, and you have the user's credentials.

662
00:50:49,560 --> 00:50:53,060
So, you can use, in this example, the expect command.

663
00:50:54,280 --> 00:50:58,060
And the expect command basically simulates user interactivity.

664
00:50:59,720 --> 00:51:09,760
And command, you know, on the man page, this is alphabetically, but there's always, there's four of them that you would practically really need to know in order to run this example.

665
00:51:10,680 --> 00:51:14,220
Spawn, which spawns the command of whatever you supply.

666
00:51:14,540 --> 00:51:17,300
Send is providing input to standard input.

667
00:51:18,180 --> 00:51:22,700
Expect parses, I think it does both standard out and standard error.

668
00:51:23,020 --> 00:51:25,480
I haven't tested that, but I think it does.

669
00:51:25,480 --> 00:51:27,540
It does both, at least does standard out.

670
00:51:27,540 --> 00:51:29,980
And then, you got interact.

671
00:51:30,300 --> 00:51:34,940
And then, that basically goes hands-on at that point.

672
00:51:34,940 --> 00:51:38,940
It's kind of like, if you ever used potent tools with Python, right?

673
00:51:38,940 --> 00:51:42,560
It's like the interactive, similar kind of mentality there.

674
00:51:43,600 --> 00:51:46,080
And so, I'll break this down.

675
00:51:46,080 --> 00:51:48,540
Expect C, you're supplying the command.

676
00:51:48,540 --> 00:51:50,980
You then spawn sudo S.

677
00:51:51,040 --> 00:51:54,000
So, it's kind of like a spawn, the spawn, the spawn thing, right?

678
00:51:54,000 --> 00:51:59,440
Sudo S, in this case, we're just going to read root.txt.

679
00:52:00,040 --> 00:52:02,340
We spawn that process.

680
00:52:02,340 --> 00:52:06,880
We then look for, with globs, it supports globbing too.

681
00:52:06,880 --> 00:52:08,860
So, you don't have to be exact exactly.

682
00:52:08,860 --> 00:52:12,940
You can, a little bit of wiggle room when you're doing your expect.

683
00:52:12,960 --> 00:52:18,200
We look for password, because that's typically what you see whenever you're prompted by sudo.

684
00:52:18,240 --> 00:52:30,220
We will provide the password, which, in this case, it's always the username, because for demo examples, you do have to provide your own enter, and then you interrupt.

685
00:52:31,460 --> 00:52:33,300
So, demo.

686
00:52:36,390 --> 00:52:37,790
Okie dokie.

687
00:52:40,880 --> 00:52:44,280
And this one will require a limited shell.

688
00:52:44,280 --> 00:52:46,380
It will require a reverse.

689
00:52:48,320 --> 00:52:50,600
These ones, three, four, five.

690
00:52:51,320 --> 00:52:52,600
I forget.

691
00:52:55,730 --> 00:52:56,450
Okay.

692
00:52:57,910 --> 00:53:01,850
So, in this case, I made a shitty little, didn't really make.

693
00:53:01,850 --> 00:53:02,750
Oh, it's one, two, three, four.

694
00:53:02,750 --> 00:53:03,450
I'm sorry.

695
00:53:04,450 --> 00:53:05,170
Four.

696
00:53:06,710 --> 00:53:07,430
Okay.

697
00:53:08,270 --> 00:53:12,210
So, it's a little crummy shell.

698
00:53:12,210 --> 00:53:13,190
You can't do anything.

699
00:53:13,190 --> 00:53:14,150
You don't have an environment.

700
00:53:14,150 --> 00:53:15,550
There's no terminals, no nothing.

701
00:53:15,550 --> 00:53:16,430
It's bare bones.

702
00:53:16,430 --> 00:53:27,310
What you might see, if you're doing a CTF, a real pen test, where you don't actually have functionality, you know, it's a limited shell, it's a limited shell, it's a limited shell, right?

703
00:53:27,310 --> 00:53:31,050
You got nothing, really, per se.

704
00:53:31,050 --> 00:53:41,770
So, in this particular instance, we can then supply the big glob that we had previously.

705
00:53:42,290 --> 00:53:48,650
And so, hit enter, and there's our flag.

706
00:53:55,160 --> 00:53:56,120
Okay.

707
00:53:56,720 --> 00:54:03,580
So, we're at the finish line now, and this one's actually a pretty quick one, and it's more recent, too.

708
00:54:04,860 --> 00:54:15,960
This one, it doesn't check for the existence of the user, and so when it runs, it executes with the arbitrary user ID, and it returns a zero.

709
00:54:15,960 --> 00:54:19,360
Zero is also root's ID, right?

710
00:54:19,760 --> 00:54:25,180
And so, and then, and that's executed for privileges, or whatever you specify on the end of it.

711
00:54:25,180 --> 00:54:38,560
And you test that out, too, because if you specify, see, in the as whom clause of this user spec, you can specify, you can't run stuff as root, for instance.

712
00:54:38,860 --> 00:54:39,480
Right?

713
00:54:39,480 --> 00:54:45,000
And so, this particular one, I actually do need to copy and paste.

714
00:54:45,000 --> 00:54:51,420
My username is the, it's not as intuitive.

715
00:54:52,240 --> 00:54:53,120
Okay.

716
00:54:53,120 --> 00:54:55,180
sudo l, right.

717
00:54:55,180 --> 00:55:08,480
So, generally speaking, if I try to do anything, either not as this particular application, or if I try to do that, but as root, it's obviously not going to work, because it is explicitly stated in the user spec.

718
00:55:08,480 --> 00:55:14,940
However, given this particular type of sudo, you don't have to worry about that.

719
00:55:15,320 --> 00:55:15,480
Right ?

720
00:55:15,480 --> 00:55:20,120
And so, let me get, excuse me while I whip that out.

721
00:55:20,120 --> 00:55:20,780
Okay.

722
00:55:24,810 --> 00:55:32,670
So, yeah, you simply just do sudo u, and there's tons of scripts, too, where you basically scrape the internet looking for this.

723
00:55:33,410 --> 00:55:34,730
They're pretty nifty.

724
00:55:34,790 --> 00:55:46,630
So, if I try to run anything other than those two, you'll get prompted by a password, which means given that there's no password, you see it asking for password, you're wrong.

725
00:55:46,730 --> 00:55:49,750
So, we'll just do id, and we're root.

726
00:55:49,750 --> 00:55:51,850
We at least have the root's uid.

727
00:55:51,950 --> 00:55:55,990
And if we do a bash, we are now root.

728
00:55:56,610 --> 00:55:57,470
Okay.

729
00:55:57,730 --> 00:55:59,610
That is good.

730
00:55:59,610 --> 00:56:07,630
So, a recap, we covered sudo, sudoers, we went through open, sudo, we covered a bunch of easier application stuff.

731
00:56:08,310 --> 00:56:10,270
This is out of order a little bit.

732
00:56:10,270 --> 00:56:11,490
Disregard it.

733
00:56:12,510 --> 00:56:22,510
And so, yeah, we covered a variety of things from different angles, from GTFO bins to some CVEs from stuff from ExploitDB.

734
00:56:22,970 --> 00:56:32,790
And just try to develop the whole mindset that you can really dig into sudo and get creative and really have fun with it.

735
00:56:33,850 --> 00:56:35,810
And so, I tried to cite as much...

736
00:56:35,810 --> 00:56:40,850
I tried to cite everything that I could that I pulled from, and I included that at the very end.

737
00:56:41,370 --> 00:56:49,450
If you happen to see your material featured in here, and I did not give you proper citation, just let me know and I'll add it.

738
00:56:49,450 --> 00:56:52,490
I'm not trying to plagiarize your stuff.

739
00:56:52,610 --> 00:56:56,870
I try to give all the citation credit where it is due.

740
00:56:57,590 --> 00:57:00,790
And that is my talk.

741
00:57:07,230 --> 00:57:09,750
Okay, do we have any questions?

742
00:57:12,070 --> 00:57:22,590
I was trying to get the mute button working, but yeah, basically first of all, thank you so much for supporting us and for the great presentation here.

743
00:57:22,670 --> 00:57:36,590
We're accepting questions through Discord, and if you just join us in the bottom of the screen, there should be, whether you're on Twitch or YouTube, there should be a link to our website, and of course from there you can actually get to our Discord channel.

744
00:57:36,770 --> 00:57:39,890
So if you have any questions for Tyler, please do so there.

745
00:57:40,430 --> 00:57:45,250
We're going to go on a brief break, and then the next presenter will start in about 15 minutes.

746
00:57:45,310 --> 00:57:46,010
Thank you again.