start	end	text
1040	5580	All right, we're back live. And thank you, Tyler, for supporting DEF CON,
5580	9880	supporting the community, supporting the Red Team Village, in order to have you here.
10040	12940	And with that said, without any further ado, take it away.
13640	18440	Hey, good evening, late night DEF CON. This is 50 Shades of Pseudo-Abuse.
18440	21100	I'm Tyler Boykin, and this will be my talk.
24080	29760	So, we'll do a quick about. And the intended audience level for this kind of thing is
29760	34980	beginner to intermediate. And there's plenty of talks on some whiz, some cool advanced stuff.
34980	39740	But I figured we'd keep it in the beginner-intermediate range.
39740	44640	Or if you're a more seasoned professional, you may pick up a few things, maybe a good refresher.
44720	51440	We'll do a brief crash course on Pseudo, on where it stands on the TTP,
51440	55860	the MITRE realm of things. And then we'll cover the Pseudovers file.
55860	59360	And then we'll hit up some enumeration and recon.
59840	63260	And then we'll go into the fun stuff, which are all the examples.
64720	70500	So, a little bit about me. I'm an Aggie communications officer with the Marine Corps.
70880	74300	Cut my teeth with network engineering and information assurance.
74300	78460	And then now I do security engineering for BioLite Professional IT Services.
78700	82000	And so you can find me on Twitter and a few other places.
83120	89320	Okay, so superuserdo, whether you're calling it pseudo or sudo,
89320	91220	we're talking about the same thing.
91640	99640	And it's basically, it allows any permitted user to execute commands as another intended user.
99640	103880	Typically, 90% of the time, it's going to be approved.
104360	109000	And the security policy, which is what we'll dive into as we're going into this,
109000	115180	determines what privileges, what allocations, what all can that user do.
117420	127120	And the whereupon authentication, specific tokens are made on the pseudo tracks,
127780	131820	each and every failed or successful authentication.
132000	137200	And it'll remember you for five minutes, so if you ever notice that, and then so on.
138480	146080	And so when you execute a command, and you'll see this later on too, unlike su, as you were,
146080	149980	the security policy just states which environment you get.
149980	155940	So whenever you are actually running sudo, you inherit all of that users in full environmental variables.
155940	161520	For instance, you get the, unless it's explicitly stated otherwise.
161520	163820	So you typically get their environment variables.
163820	167740	You'll get a variety of IDs, right?
167740	171340	And unless you specify otherwise.
171540	175080	Real effective user IDs, group IDs, right?
175080	178700	You get a good variety of things up there.
178700	180800	But it's as the target user.
182820	185920	And these are straight out of the sudo man pages.
185920	191940	I'm just going inch deep, mile wide stuff, just to kind of give a little bit of a background.
191940	195020	There is no easy way, right?
195020	197000	There is no easy way.
197060	208240	And this is to prevent a malicious user from escalating, abusing stuff if stuff is allocated.
208240	212140	Simply because there's a whole breadth of things.
212300	219480	There's this breadth of applications and features that can be manipulated maliciously.
219480	222620	It gets rather hard.
222840	226000	And so, I mean, there are ways to mitigate this.
226000	234980	You force, at least you really crank down on the least privileged kind of method of security and whatnot.
234980	239880	But it's really, you have to be particularly stingent when allocating stuff.
240480	244640	Okay, so we'll kind of shift gears here into Mitre.
245100	249000	And so it falls under abuse elevation control.
249000	251340	So this shouldn't be anything new, right?
251340	257580	This is pretty similar vernacular to what we've been talking about the past couple of minutes.
258140	265880	Adversaries may circumvent mechanisms designed to control and elevate privileges to higher level and so on.
265880	274040	And so where the sudo and the sudoers falls into is now the new format, which they went to sub-techniques.
274220	277020	And I'll give you all a quick minute to read that.
277020	278460	I think I've got it.
278880	280260	No, I'm just kidding.
280860	284080	So basically it says the same thing.
284120	291460	Adversaries may perform sudo caching, and that's to where they go after those token files.
292060	298800	And so in the directory, each user that attempts to authenticate via sudo gets their own specific directory.
299180	303400	And then each attempt has its own little file. It's kind of cool.
303400	311860	And then adversaries may attempt to abuse the caching or misconfigurations in sudoers,
311860	323620	and that is where you'll actually wind up seeing a lot of the stuff for all this talk are mostly out of sudoers misconfigurations.
325400	328320	Okay, and that's a good segue.
328320	335240	So sudoers is the primary configuration file when you're working with sudo.
336200	338360	It resides in Etsy.
338620	342880	Technically, you can edit it with whatever you want to.
342880	347820	That is not encouraged because it is very syntax picky.
347920	352320	So generally speaking, you make a copy of it and you use visudo.
352800	361440	And if you use visudo to edit the file, it'll run the error checking, the syntax checking immediately upon exit.
361460	367940	Or you can just, let's say, if you wanted to tweak something, mess with something, you can always just run the standalone checker on the file.
375270	377650	So that's what it's basically going to look like.
377650	379150	You're going to have...
381450	385470	If you make a misconfiguration anywhere in sudoers, it'll yell at you.
385470	387250	Like that.
387310	391250	And then if you're good, then it tells you, okay.
394030	399970	So the sudoers specifies the who, what, when, where.
400030	401670	It's the be-all, end-all.
401670	406130	Other documents contribute to this whole security order, this whole policy.
406130	412270	But the main point of configuration is sudoers.
412270	420170	And so unlike... by default, password authentication is required, but you can specify no password.
420310	427350	But unlike su, where you authenticate as the user which you are trying to do stuff as, so let's say root.
427350	430190	You authenticate as root.
430230	436350	Sudo, using sudoers, you authenticate as the user calling it.
436350	439450	And so it's a little bit less.
440710	443850	And so the file is composed of two main parts.
443850	445970	It has some other sections, too.
447890	450950	And you can go into a little bit more detail about that.
450950	458030	But for the purposes of what we're doing here, you're going to have your aliases, which are kind of like variables and placeholders.
458610	465070	And then you have your userspecs, which are the five Ws.
465090	467990	And there's quite a few userspecs for these examples.
470010	475370	And so when multiple entries stack up, they're applied in order.
475510	477270	You see that a lot in userspecs.
477270	481310	And then if there's... and then it racks and stacks into the last one.
488320	490000	So, aliases.
490120	493920	The interesting thing is that these syntax on the man pages are actually a little less...
493920	497940	When you see them in a sudoers file, it kind of makes sense because stuff, right?
497940	500020	But the format kind of eh.
500020	502400	But essentially, it's alias type.
502400	503660	Name.
503660	506740	And then you go on and you can specify whatever you're trying to alias.
506740	510080	And then you have your defaults that you can always set to.
511720	514200	And so, moving on a little bit.
514200	519820	The sudo allows for shell-style globs and wildcards.
519900	527520	It's not actual regex, but if you've ever done anything in bash or shell or whatever, it's similar in functionality.
527840	531360	An asterisk is one or more.
532020	535000	And then question mark is any single character.
535300	541900	You can kind of do range, kind of splitting between brackets and so on.
541900	547400	But this isn't... it's not actual regex, but it functions similar to what you see in bash or any kind of shell.
549840	552680	Okay, so we're down to the user specs.
552920	556480	And this is actually a little bit more of the intuitive part, in my opinion.
556540	559160	Because it basically... it's the who, what, when, where.
559160	560720	You have the who, where.
560720	563640	In the parentheses, you have the as whom.
563700	571920	And you can use colons to delineate further detail into that.
571940	573140	And then the what.
573140	579880	And then sandwiched between the what are tag specs that kind of throw stipulations on some of the activities on how it's done.
579880	582720	And we'll go into that with the next slide or two.
582720	585700	And so the run as spec.
585700	588000	So, for example, me at server.
588240	590840	Me at host server.
591100	593880	You know, as operator, these commands.
594440	595780	It's not to the web.
597280	600100	And so tag spec, and this is what I was talking about earlier.
600100	604500	It sandwiches in between the as whom and the command part, right?
604700	610540	And this can either greatly, drastically make a red teamer's life easier
610540	613860	or it can make it a little bit more difficult, make it more complicated.
614420	618280	No password, you'll see sometimes.
618960	625220	Set in will also, you can deliberately manipulate the environment when you're calling those commands.
625220	632460	And no exec prevents dynamically linked applications from actually calling shell on themselves.
632460	634920	Or running commands themselves, you know.
634920	638720	And we have an example of that later on also.
638720	641760	But I'm going to hope for that no password.
642160	643440	So much easier.
644160	646880	Okay, so enumeration.
649400	650960	So there's manually, right?
650960	652300	You have sudo l.
654080	659920	And if you're lucky, and this could be for any kind of real-world pen testing, CTFs.
659920	662160	Could be for any type of thing, right?
662320	663720	You have sudo l.
663860	665480	And it might be as easy as that.
665480	668000	The user that you may have compromised may be a sudoers.
668000	675560	And when you do sudo l, you may get a listing of every, you know, what all that user can do, right?
675560	677500	You have etcdoers.
678380	680400	It should, hopefully it exists.
680660	685260	If you can read it as an unprivileged user, I think there are bigger things going on.
685260	687700	Or you're in a CTF, you know.
687700	692560	But, I mean, that would help you help enumerate and get a bigger picture of things.
692800	697100	In the event that you cannot, for instance, let's say you can't do sudo.
697100	700200	But you're still trying to look at version numbers or whatever else.
700200	705360	You can still get the version number from sudo with capital V and just do some googling.
705700	709020	You know, maybe you can find a user or service that can't use sudo.
709020	712140	And then you may be able to leverage that for exploitation.
713080	714280	Etsy group.
714280	715840	And so, same thing.
715840	719860	You can see additional users that may be in, you know, the sudoers group.
719960	726400	And then one of the places it logs is to var log or auth log.
726400	729420	And so, that's all manual stuff.
730340	736380	And generally speaking, because this is a subset of privileged escalation.
736380	742540	So you don't need as much expansive tools and resources to really enumerate what you have, per se.
742540	745180	You know, let's say if you're doing some other things.
745260	746860	But there are automated things.
746860	750420	For MSF, you know, you have post modules.
750800	752840	I think the interpreter has a few also.
752840	755500	And then there's some pretty well-known scripts, too.
755500	756700	Like linenum.
756720	761920	Anybody who's done CTLs and some other things has used linenum.
761920	763940	That's a pretty well-known one.
764040	766520	Follow sudo is actually pretty neat also.
766520	772080	And I make another reference to the creators of that.
772100	776540	And that particular one in the middle references that for that particular CVE.
777400	784520	Okay, so examples.
785360	789480	So this is from the creator, follow sudo.
789480	795160	And this is more the degree of examples.
795160	797900	Because it's kind of a spectrum.
797900	802800	And I like to use the fruit, the hanging fruit kind of analogies.
802800	807440	So the two examples, a complete lack of configuration.
808000	810180	It's nothing wide open.
810180	811680	It's low hanging fruit.
812020	813360	That's the lowest hanging fruit.
813360	815480	And you should go for the lowest hanging fruit first.
815480	817140	Because those are the beginnings.
817480	819120	Or you might see...
819860	823600	They've tried to configure secure sets of rules.
823600	827120	But there may be a bug in one of the applications.
827420	828780	It may be something flagged.
828780	830120	Or they just didn't know.
830240	832300	But they're trying.
832300	837840	Or it just may not be configured consistently throughout whatever they're doing.
838180	838640	Right?
838860	845740	Which is actually pretty normal for any other kind of real system hardening and whatnot.
846420	847600	And you get the lowest of the fruit.
847600	848820	You get the open sudo.
848860	852860	And then you've got the top part, which is the fairly secure, as he's mentioning.
852940	857800	But for today's purposes, we're going to be mostly residing mostly in the middle.
857800	859420	You'll have a little bit of low fruit.
859420	862500	And we'll have a little bit of the cool stuff up at the top.
862500	864300	But the middle is going to be...
864300	865620	That's where the fun playground is.
865620	868880	Because it's a little bit gamier, in my opinion.
870480	871200	Okay.
871420	876520	So when you're doing this, you want to get creative and inventive.
876520	885280	Because you don't necessarily have to get a fancy CVE, per se, with these.
885280	894180	You don't have to make an alphanumeric fricking rock chain or anything like that.
894180	896900	You're just using what exists creatively.
896900	898560	And so that's kind of the cool part about it.
898560	900800	And can you read something off limits?
900800	902140	Can you write to something?
902140	906160	If you can write to something, then you can go really far then.
906300	906800	Right?
908900	911700	This is where you're scouring the man pages.
911700	914700	And you're looking for flags.
914700	917500	You're looking for little subtle things that may be kind of useful.
917500	919900	And that's why it's more fun.
920360	923760	And it's kind of a misnomer, escalate laterally.
923760	925440	You may be able to move laterally.
925440	932540	I haven't really seen any non-root users specify in sudoers.
932540	933460	But that's an option.
933460	935460	You can do sudo as a different user.
936980	940420	But using that gets you to a different user.
940420	943940	I mean, that's worth mentioning on a pin test report.
943940	946500	And that may get you to something bigger and better.
946500	948540	It's not always about up and down.
948540	950040	Sideways works too.
950260	950860	Right?
952060	958360	And so with that, we are now entering low-hanging fruit.
958900	960840	So this is the easy stuff.
960840	963260	Open sudo, the classic example.
963260	968320	Wide open, user authenticates as himself, his or herself, whatever.
968320	972060	And then the system is their oyster.
972060	975100	Their one step, their keystrokes away from root.
976160	978780	And so you go into a little bit more.
979200	990120	So these, any applications that directly result in a shell, they're pretty much right next to there.
990220	994080	This is your SH, KSH, ZSH, whatever, right?
994080	995200	SU.
995200	1002080	And any actual programming languages too, because those can, again, cough up shells.
1002420	1004760	Cough up shells, cough up functionality.
1006260	1008780	Those are pretty big gummies.
1011060	1014280	And so then we go, this is kind of like a little bit higher.
1014280	1019220	We're turning up the volume on the creativity a little bit, right?
1019220	1024340	And so you've got commands, right?
1025180	1031640	And so you're not, they don't give you, they can give you instant shells, but it's not right off the bat.
1031640	1033540	So you've got to dig for stuff a little bit.
1033540	1035080	And you have to use stuff unintended.
1035620	1037780	You've got to think outside the box.
1038200	1041580	And so that's why I think, that's why I kind of like some of these.
1042100	1043620	And so here are a few examples.
1043620	1045680	When you do wget, right, for instance.
1045680	1054900	If you supply I as an input file, it'll attempt to read each line in that file as its own URL and it'll attempt to shoot it.
1054900	1058940	So if you do sudo wget whatever, say Etsy shadow, right?
1059060	1064880	Each line of Etsy shadow is going to be, wget is going to try to resolve or make a request to each line of Etsy shadow.
1064880	1068540	I mean, it'll fail, but that's file read, right?
1068640	1072300	You're now reading sensitive files that you're not supposed to.
1073340	1075160	And same thing with curl.
1075660	1077420	And this one's actually kind of cool.
1077420	1080400	These are two web request applications.
1080720	1084380	And you don't even have to make an actual web request for them, really.
1085220	1086600	So it's kind of neat.
1086600	1088240	And so you continue to offset.
1088900	1092020	And then it'll automatically find where to resume.
1092020	1096920	And you basically specify the remote name, which is local.
1096920	1098580	And so then you specify file.
1098580	1111500	It actually accepts in this format here, file, kind of like you're doing FTP or whatever, or HTTP, the location on the local system.
1111500	1116760	And it'll download it and you can read it.
1116760	1118160	It's actually pretty neat.
1119420	1121800	Base64 is another interesting sample.
1121800	1122640	That's file read.
1122640	1124060	I think that's file write also.
1124060	1125280	I'll have to double check.
1125280	1130100	But essentially, you're looking at, it's file read.
1130100	1134480	And if you pipe it into itself and supply the D flag, you have the clear text.
1134560	1136320	You have it on 64.
1137600	1146520	And then GCC, if you supply wrappers, it'll run the command that you supply.
1146520	1152560	And all params are passed comma separated after the initial command.
1154020	1157020	And then at the very end, we're tagging along.
1157020	1162140	Let's say you have kind of a bug or like a big, gaping kind of bug thing.
1162460	1169810	And it's kind of a mix between the high level and low level.
1170120	1176480	But any bugs that are incurred at sudo are going to have sudo consequences also.
1176480	1182120	So, where's my demo thing?
1182120	1182780	Okay.
1182900	1187820	So, we will do some shell time.
1187820	1188800	How about this?
1189180	1193240	So, L, section one, open sudo.
1193240	1196000	So, yeah, sudo L, right?
1196000	1200780	Anything, you do sudo su cat root text.
1200780	1201560	That's what it looks like.
1201560	1205420	That's what I'm using for these particular purposes.
1205420	1208400	Looks like that kind of jazz, right?
1211260	1217160	So, apps, sudo L.
1217460	1219780	And so, this is pretty much the same thing too.
1219800	1223460	If you run sudo is in the top two, you're going to get an instant shell.
1224080	1228320	Creatively, I think the kind of neat one and one that you can use for if you're working,
1228320	1231900	trying to get a non-limited shell is with the Python.
1231900	1240170	And so, Python, most interpreted kind of languages and some things, except inline commands, correct?
1240720	1249060	So, pity spawn, pity the fool, bash, right?
1249060	1250360	And so then your root.
1251120	1253960	It's pretty cut and dry.
1254000	1256200	It was pretty straightforward.
1256760	1260940	So, now we're getting into a little bit more fun stuff with wget and whatnot.
1262060	1270560	So, if you notice, it accepts an input file.
1270560	1276450	And so, basically, that's what it looks like.
1276450	1280110	It tried to run the flag in our particular case.
1280490	1285890	It tried to make a request to it and obviously it's going to fail because it's nothing, right?
1286270	1291430	And so, that was pretty neat when I first learned that, right?
1291430	1294990	And so, base64, similar thing.
1295930	1303830	It comes in as you're basically piping it to itself and you're specifying the D, which means decode.
1306570	1309710	So, here we go.
1311390	1313730	Wrapper, we have got root.
1314590	1316270	It ran sh.
1318090	1322230	And then, lastly, for this little bit, curl.
1322230	1327670	So, it literally downloads and the spot into the local directory.
1330110	1331650	We've got the flag.
1332970	1334930	Bada bing, bada boom.
1335470	1342430	And so, in this particular instance, it's just a small program, say, mycat, right?
1342430	1343730	Just to show an example.
1343730	1355450	Obviously, and didn't mention this before, but as we progress along, you'll see a common trend of applications having more than one exploitation vector, right?
1355450	1358210	So, it may not just be file read.
1358210	1359490	It may can do file write.
1359490	1362950	It may be able to do commands, right?
1362950	1369010	It just depends on how you work it and whatnot.
1369010	1377130	And so, in this particular case, it basically takes in through standard input and sends that to system, right?
1377130	1380110	So, there's two, at least two with this one.
1380110	1386630	So, I do sudo mycat, do root text, write file read, sensitive file read.
1386630	1393930	You can also write bin sh, get root.
1393970	1398010	Typical string exploitation.
1401890	1403010	Okay.
1404890	1407210	Okay, now we're going to get a little bit fun now.
1407210	1408950	So, pager abuse.
1411510	1413910	Okay, those got mixed up.
1413910	1415150	Okay, so pagers.
1415150	1427410	So, whenever you run man or service or any kind of terminal editor, and those things where you can scroll up, down, left, right, it's called a terminal pager.
1427970	1433490	And the interesting thing is that people know what it is, but they don't know what it is per se.
1433510	1437850	But it's basically what happens behind the scenes is a terminal pager gets called.
1437850	1444710	And they accept extra commands.
1444710	1452730	When you supply an exclamation mark, anything proceeding that exclamation mark gets run as a command.
1454070	1458150	So, your editors, you know, vim, nano, etc.
1458610	1461190	And so, yeah.
1461190	1463630	We'll go ahead and show that right quick.
1463630	1477120	Like, l, section2, pagers, if I can type, l.
1477620	1483340	So, yeah, if I do sudo man man, quick example, we're now in a terminal pager.
1483580	1485740	You can go up, down, left, right, whatever.
1485740	1490380	By simply just typing stuff, it'll start parsing your input.
1490380	1495580	And by doing exclamation mark, everything after this will be run as a system command.
1495580	1500360	So, vim sh, we're now root, etc.
1502740	1505700	Same thing with service, too.
1505700	1510100	So, sudo service blank status.
1510100	1511920	I'm going to get all of them.
1511920	1513860	I'm going to open up a pager.
1517260	1520760	vim sh, easy peasy.
1520760	1526200	And so, a neat thing is you tend to forget these types of things.
1526200	1530280	But let's say you do a service, but it doesn't have that much output.
1531700	1534360	It's more just kind of terminal fundamentals, perhaps.
1534500	1536640	Let's say you do cron status, right?
1537600	1541000	And actually, it does do a pager right there, midway.
1541020	1546580	But for whatever reason, if the pager ends prematurely, let's say it finishes,
1546580	1549140	you can always just shrink your freaking terminal down to like here.
1549600	1556040	And then do it again, and it'll open up the pager for you.
1556220	1557620	So, I think that's kind of neat.
1565820	1569920	Yes, GTFO bins. A lot of these are on GTFO bins.
1569920	1573880	Now, I tried not to just go down and just start listing them off.
1573880	1575780	I tried to grab a variety of different things.
1575780	1583040	So, yeah, GTFO bins is definitely very, very handy.
1583040	1587620	If you're not using that, you're definitely crippling yourself in what you can do.
1588060	1589480	Okay, cron abuse.
1589620	1591680	So, this kind of goes without saying.
1592320	1599100	If you can edit, you can manipulate or run or do any kind of service type things
1600800	1604760	as root, that's going to have root-like implications.
1605620	1610560	And so, that's a pretty short slide.
1611040	1619120	But, so, sudo l, or s-u-l, sorry, section 3, cron l.
1620420	1622860	Yeah, and so in this particular instance, right,
1624060	1627360	and so it's actually worth noting that if you do cron tab,
1627360	1632400	if you haven't done it before in the system, and you don't have the right environmental variables set,
1632400	1633880	what's the first thing it asks you?
1633880	1637180	It asks you, what editor would you like to use?
1638000	1646880	And so then you have editor-style exploits with whatever kind of services you can do also.
1648480	1653060	So, in this particular case, sudo l.
1653280	1659240	So, let's do sudo cron tab e, and I already have something set up,
1659240	1668160	but now we're in Vim, right, so any kind of root, easy peasy.
1668240	1676600	But, it's also the implication that you can edit the root's cron tab and run stuff as root, any kind of services.
1676600	1682260	In this particular case, I have this little script here, and all it does is, just for the example,
1683460	1687720	it basically reads in root text and writes it to the current directory.
1687720	1690820	It's pretty easy peasy.
1690820	1695760	So, sudo service cron start.
1698610	1700550	And you'd have to wait a minute.
1700730	1706890	And let me see what's going on, on the Discord.
1706950	1707790	Okay.
1708570	1714010	So, at some point, probably in a minute, I might not just wait for it,
1714010	1718470	but we'll see root text should hopefully populate up here.
1719810	1722070	But, I don't think I'll wait for that.
1722630	1724790	So, you'll just have to deal with it.
1725130	1727950	Okay, so now we're getting into a little bit more fun stuff.
1728230	1730030	LDPreload is actually kind of neat.
1733550	1736970	And you need a bit of a background to understand what's going on.
1736970	1742190	So, LDPreload, it's an exploit.
1742450	1749210	You're using a feature that is intended to be used with dynamically linked binaries.
1750350	1758290	Whereas, all the methods and all the stuff is resolved at runtime,
1758290	1759830	whereas it's statically linked.
1759830	1762950	You get that bigger file if you statically link everything,
1762950	1767870	but you don't have to worry about shared objects being all messed up and whatever.
1767870	1771370	You have everything in one nice big package.
1772230	1778550	But, obviously, with dynamic linking, you do have a smaller file size.
1778550	1785050	You have your typical libc and a bunch of other things to worry about.
1785050	1788430	But, overall, it's a little bit more flexible.
1789910	1800870	And so, with the LDPreload, you can essentially tell it to load that stuff before it loads the other stuff.
1800870	1809330	And so, you can essentially overwrite any kind of method or function in whatever application you're running.
1809930	1814310	And so, we need to put a few things together.
1814310	1819670	You're combining a custom functionality with a binary that's being run as pseudo.
1819890	1822130	And, obviously, that's going to equal fun.
1822210	1823790	Pretty fun.
1823790	1826890	And so, you'll see this in the environment.
1827150	1831490	Whenever I've seen it, it's been in the environment.
1831650	1834170	And the binary also has to be compiled for it.
1835350	1841650	And so, the syntax for when you want to go about business with this, the pseudo LDPreload,
1841650	1848930	you can export it to the env, to your environmental variables,
1848930	1852610	or you can just run it all in one, like how we're about to do here in a minute.
1853650	1856590	So, demo.
1861740	1866240	So, L section for LDPreload.
1867880	1872900	So, in this particular case, we can run the example.
1872900	1876620	And I tried to cite, I got some of these examples straight off the internet.
1876620	1877940	I tried to cite them.
1877940	1881600	You can find these, I'll link to them, so if you want to look at them, reference them too.
1882300	1889400	So, in this particular case, the example was, it runs a loop, and it prints 10 random numbers.
1889400	1893700	It calls ran, and it outputs the standard out 10 numbers.
1893820	1898600	So, in this particular case, because it's a dynamically linked,
1899800	1906880	we can provide our own stuff, and we have the LDPreload environmental variable set.
1906880	1916220	So, in this particular case, cat drandom, and basically, it's going to overwrite the rand function,
1916220	1918900	and it'll just return 42.
1919120	1923640	So, example C, right here, right?
1923640	1929520	And so, you're basically going to, essentially, you're going to make that do what you want it to,
1929520	1931540	which is kind of cool.
1931540	1933920	So, for this particular example,
1944670	1964750	So, sudo ldpreload drandom, shared object, to example.
1964750	1969550	And, as you see, we basically made random do what we want to.
1969550	1973930	So, it's no longer random. It just prints 10 42s instead of a bunch of actual random.
1974050	1979890	So, taking that a step further, oh, we can manipulate the file as sudo.
1980070	1981650	So, what do we do?
1982190	1984310	We get evil.
1985550	1989910	And, in this particular case, we're overwriting init, which happens right off the bat.
1991590	1995330	And, you know, we basically pop shell.
1995830	2003470	And so, using a similar type thing, evil, we are now rooted.
2003470	2004430	It's pretty cool.
2004430	2010370	And another cool thing is that it'll finish running the rest of the application once we exit.
2010370	2010970	See?
2010970	2014270	Because we only overwrote init. We didn't overwrite the rest of it.
2014270	2015410	So, it's kind of neat.
2016010	2017130	Okay.
2022610	2023170	Okay.
2025090	2026210	Installers.
2026250	2033990	So, it goes without saying, right, that installing any kind of application is a security concern,
2033990	2039910	especially if you're going to install it as admin, as root, any kind of privileged accounts, right?
2040150	2045430	And so, these can definitely be leveraged in various kinds of ways.
2045430	2047890	Pip, apt-get, dpkg, you name it.
2049330	2054370	And so, for instance, a lot of these have multiple, let's say, apt-get and dpkg.
2054370	2056550	They both invoke a pager.
2056790	2061610	You can do stuff during install, providing custom functionality.
2061950	2068750	For example, pip, when you're in setup, you can specify entire methods for doing stuff.
2068950	2071090	It becomes your oyster.
2071090	2079150	So, obviously, installing things as root is a big, critical security consideration.
2080950	2082190	Okay.
2082190	2085470	We will hit that up.
2094470	2098090	Okay, so, sudo l.
2098970	2103810	Okay, so, how does one make that a shared object?
2105970	2109450	You compile and link.
2110110	2114590	You basically don't do the full process when you compile.
2116210	2121250	If somebody doesn't share that with you, we can grab that here after this.
2122070	2130470	But basically, you make it a shared object, and it can be used by other dynamically linked applications.
2133150	2137630	So, let me grab my thing real quick, y'all.
2138210	2145050	Okay, so, for the pager, right, pager abuse, sudo apt-get.
2145900	2147250	Not bad.
2149430	2151090	Change log.
2154270	2156990	See, we now have a pager.
2157250	2160090	So, the old stuff still applies.
2160350	2169150	And so, having that kind of mentality that, oh yeah, we're in familiar territory, it will help us for later on.
2169150	2176970	And so, in this example, we have apt-get shell package.
2176970	2183230	And all it's doing, you're basically providing custom functionality, and it runs at the very end.
2183230	2194450	So, all you gotta do, you can specify, instead of making a normal web request out, you specify a local file for which to draw from.
2194450	2197810	And then it basically goes like that.
2199150	2200190	It's pretty cool.
2203620	2209820	And the same thing with, when you go to setup, or setup, excuse me, pip.
2209980	2220420	So, in this particular case, we have a setup py, like what you'd see in any, if you're installing any kind of module, any kind of thing written in Python or whatever, you'll have your setup py.
2220840	2225340	And in this particular case, it actually does a reverse shell.
2225340	2229080	And so, I'm gonna use, I need to split screen for a minute.
2229080	2235150	I think that one was 1, 2, 3, 4, 5.
2236710	2239210	So, 1, 2, 3, 4, 5.
2239210	2247290	We do sudo pip install . to specify from the local directory.
2248290	2249410	And we do.
2250210	2251330	And we have.
2251810	2252870	Bada bing.
2253730	2255050	Pretty cool.
2256390	2258070	Exit. Exit all out.
2258070	2259250	All that jazz.
2259250	2260690	Okay.
2263940	2265280	Right on, right on.
2266860	2269960	So, path and secure path.
2269960	2279320	So, these, so if you recall back, right, globs and whatnot are acceptable within the sudoers file.
2279460	2283960	The asterisk, star, whatever, is what are more?
2283980	2286140	Question marks, new characters, and so on.
2286140	2292360	So, and this is kind of in the same family as your normal environmental variable path, right?
2292360	2295820	It's in the same vein of exploitation.
2296280	2302840	If you see asterisks, you see stars in the sudoers file, you can have similar consequences, too.
2303160	2307660	So, it's kind of similar in this particular case.
2307660	2313500	Not exactly, but for example, if you see a dot, an emf, it's gonna read from the current directory first,
2313500	2315320	wherever it's being invoked, and then it goes on.
2316560	2319300	It goes on down the line, right?
2319300	2322820	And if you see an asterisk, that means anything for that directory.
2323240	2325880	And so, that's what's happening in this particular case.
2325880	2329420	You know, anything in bin, you know, is free game.
2329620	2332200	And so, obviously, that's not particularly secure.
2332840	2338640	And so, interesting enough, for sudoers, right, you have the secure path.
2338640	2346420	So, if you don't actually trust the environmental variables at the lower level to be well-formed or whatever,
2346420	2350360	or to be secure, you can kind of override that with your own secure path.
2350700	2359740	But obviously, if the secure path is misconfigured, that's fun for more than one person involved.
2360800	2369440	So, and in this particular example, we made secure path temp to show that it's kind of a misconfiguration of sorts.
2370720	2376200	So, l section6 path.
2376200	2379240	I believe for this one, I'm doing the bin.
2379240	2386440	So, and it's also worth noting, right, in other kind of privilege escalation mindset,
2386440	2392220	that, you know, I can run anything in this directory.
2392220	2396480	And so, as sudo, so you can basically write your own shell.
2396480	2400740	You can do whatever, and it'll run what you want.
2400740	2404300	So, in this particular case, I just made id, it runs shell.
2404400	2405880	It's weird, but whatever.
2405880	2414140	You know, and so, sudo, let me copy all that, I ain't typing that stuff.
2414180	2416260	Boom, id.
2420900	2424260	It's pretty intuitive.
2424400	2429620	And then, sudo l.
2429760	2434680	So, this particular one, it's going to check temp first.
2434680	2437120	Because that's a misconfiguration on the secure path.
2437180	2438040	And it's a particular one.
2438040	2441260	And there's actually another exploit later on that utilizes double stars.
2441260	2443300	But this is for the example, this purposes.
2443680	2446620	You know, where is usually, where is ping usually at?
2446620	2449140	Ping is usually user bin, right?
2449140	2458580	But obviously, if we do sudo temp, and ahead of time, it's a temp to ping, right?
2458580	2465100	You get the flag, because in that particular file, it does the same thing.
2465100	2467080	It's just reading and printing, right?
2468060	2474260	And so, that's just insecure path considerations when you're using globs and whatnot.
2475700	2476440	Okay.
2479630	2483830	So, we're getting there.
2483830	2484790	We are getting there.
2484790	2486210	Okay, so this one's kind of neat.
2486210	2488330	So, editors and sudo edit.
2489150	2491710	So, you have your obvious kind of blatant stuff.
2491710	2493590	You already got your pager and whatnot.
2493590	2498170	And anything with editors, you have file read, file write, any kind of commands.
2498170	2500610	But how it does some things are kind of weird, right?
2500610	2508730	And so, there's a few new things I stumbled upon while I was even making this in the past months.
2509990	2515510	And we will include an actual CVE with this also, because it's kind of in the same line of things.
2516410	2518310	And this is the actual CVE.
2518310	2519910	It's on exploit DB.
2521410	2525710	Sudo edit does not check the full path.
2525710	2527150	So, if you use double globs.
2527870	2533450	And so, the POC for this is you create a send link to anything sensitive, right?
2533470	2539970	Anything sensitive, and it'll resolve that as correct, and it'll run it.
2540250	2541630	And you're good.
2541810	2543030	It's pretty cool.
2543790	2549510	So, we will get to keyboard mashing.
2549990	2555570	L, section, 7, editors, clear.
2555570	2557050	Sudo l.
2558470	2559530	Okay.
2559530	2561910	So, we can do that one first.
2561910	2567090	So, in this particular example, we have two directories.
2567990	2572870	Test2 with protected, which is the actual symlink to it.
2573650	2576250	It's going to Etsy Shadow right now.
2577270	2577970	And then we have...
2578410	2580850	Let me scooch that up a little bit for us here.
2581330	2582270	There we go.
2582550	2582970	All right.
2582970	2584370	And so, var...
2584370	2586030	I just made some dirs.
2586030	2586870	And this one is...
2587510	2588950	It's actually really nothing.
2588950	2590690	I think it has some stuff on it.
2590690	2591950	I forget what I put on there.
2592150	2598750	But, either way, the user can't access either of them, because it does not have the permissions.
2599350	2599590	All right.
2599590	2600050	But...
2600050	2601590	So, if I were to do...
2602870	2603590	Sudo...
2604670	2605990	Sudo edit.
2605990	2606970	Right.
2607290	2608590	And then specify...
2610990	2612870	Test2 protected.
2614310	2615750	Oops.
2618480	2624100	So, it is worth noting that if you fat-finger something, you fat-finger it,
2626800	2629220	it will ask you for a password.
2629220	2636800	So, if you specify no password on a security policy, and whatever you're doing is prompting you for a password,
2636800	2643440	then that action is not covered under the policy, and you're likely not going to be able to do it.
2658290	2659630	Sudo edit.
2667600	2668880	There we go.
2668880	2669380	Okay.
2669380	2672240	And so, now we are in anti-shadow.
2672880	2674880	I must have been fat-fingering something.
2675920	2678880	And so, this next example is actually kind of cool.
2679140	2681840	So, we have this entry right here.
2681840	2683000	No password.
2683240	2686660	So, they're trying to lock us down to them, but they also have no exec.
2686880	2691220	And so, if we recall what no exec is, it means no shells, or you can't run commands.
2691220	2693420	You especially can't pop shells, right?
2693500	2698060	And they are trying to lock us down to where we can only edit this particular file,
2698060	2701940	which doesn't exist, but you can obviously open it.
2701940	2705780	You can create the file and then save or do whatever in them.
2706300	2709240	So, and we'll test that theory, right?
2709240	2711700	Sudo them.
2711700	2714100	Let's say we want to do root.txt, right?
2714220	2718000	Can't do it because we're being prompted by password.
2718080	2723700	Let's say if we use sudo them, and we actually do go to this.
2728470	2729130	Right.
2729130	2732350	So, obviously, and if we try to do our typical shenanigans, right?
2732350	2734930	Nope. Denied.
2734930	2736650	No shell for you, right?
2736650	2741050	It's pretty cool, but here's a neat trick.
2741050	2747510	You can source externally from within editors to doing your own stuff.
2747510	2751770	So, colon E for edit, R for write, for read, right?
2754840	2755920	Exactly.
2756280	2758080	So, I think that's pretty neat.
2758080	2764320	And then you can basically kind of wiggle around from inside, kind of like that.
2766120	2766940	Okay.
2767320	2770600	We are hooking and jabbing.
2770600	2773240	We got a couple more, and then we are done-skies.
2774000	2775140	So, PwFeedback.
2775140	2781760	This one is an actual, this is also an actual CVE and has an exploit db entry.
2782560	2786880	So, basically, in older renditions of sudo,
2786880	2791360	it will ask you for your password, but when you supply stuff via standard input,
2791360	2793720	it gives little stars.
2794040	2798040	And, essentially, there is a stack-based buffer overflow,
2798460	2803460	too much input through standard input,
2803460	2806100	and you supply long enough of a string,
2806100	2811140	you can then put in whatever malicious badness, goodness that you want.
2811140	2820360	And it's actually a pretty simple exploit, and it's pretty simple to check out.
2823160	2826060	And we will go ahead and do that.
2827480	2830420	However, I need to see what user...
2830420	2831580	One second.
2832380	2836760	I need to get what I call these, because I don't call them all intuitive names, per se.
2837720	2838660	Eight.
2839340	2840560	Oh, that one is.
2840560	2842120	Okay.
2843880	2846260	Okay, pwfeedback, right?
2846280	2853140	So, sudo l, in this particular case, we do need it this time.
2853760	2857560	We do need it to prompt us for a password, so we can actually exploit,
2859420	2861800	we can smash the stack, basically.
2862860	2866280	And so, I have two POCs,
2866280	2868920	and then I think once you can find it on...
2868920	2870820	I think I'll link to at least one of these.
2870820	2872760	They're pretty self-explanatory.
2873440	2881140	So, this first one, it's 100 As terminated by a null, and it does this 50 times.
2881480	2888200	And then after that, you can pipe in whatever commands you want, generally speaking, after the S.
2888200	2902540	And so, for instance, if I were to do sudo, actually, POC, rear root, right?
2902540	2906740	And notice in here, we're not actually supplying a password.
2906740	2908940	It did ask us for a password, right?
2908940	2912960	So, if we do sudo whatever, it asks us for a password, and we had to supply it.
2912960	2916560	But because we smashed the stack, basically, and then supplied our own command,
2916560	2919660	that's basically how we went out of business there.
2919660	2921400	And the same thing with POC2.
2922340	2923660	It's the same concept.
2923660	2925200	It's just more fanciness.
2925200	2928500	In that case, it does a reverse shell, like before.
2928880	2932240	Okay, we have about 10 minutes left.
2932560	2933800	I'm going to go ahead and...
2933800	2935420	Yeah, we can do that one, too. Why not?
2935940	2936940	Why not?
2936940	2938620	Demux.
2941460	2944500	This one was 3.4.
2946700	2948460	POC2.
2950000	2951760	Hmm.
2951760	2953560	That's curious.
2953700	2955560	Oh my god.
2956400	2958800	Well, they all almost worked.
2964550	2965690	Hmm.
2965750	2967910	Might have to fuck with that later.
2967910	2970550	But they'll get the general principle.
2978920	2980240	Demo gods.
2981380	2981920	So...
2982700	2983780	Okay.
2984640	2985860	Limited shells.
2985860	2987480	This one's actually pretty neat.
2987480	2990560	And I learned this, actually, by doing Pentester Academy.
2990920	2997400	And if you're trying to look for different neat kind of ways to enhance your existing skill set,
2997400	3000260	or learn completely new things, I highly encourage that.
3000260	3005360	I'm not trying to show for Pentester Academy or BVIC, but he's a great instructor,
3005360	3007220	and they have some great coursework.
3007220	3011980	And so, in this particular one, just showing this particular example.
3012920	3015700	And it's kind of a hypothetical, too, right?
3015780	3023280	So, let's say you have a huge credentials.
3023860	3029520	Normally, you would be able to do sudo as a user, but you do not have a full TTY.
3029680	3033020	Let's say, for whatever reason, you can't make a full TTY.
3033020	3039260	You can't do the SOCAT, the STTYRAW echo trick, all those normal things.
3039260	3040820	Let's say those aren't working.
3040820	3045000	But you still have a limited shell, and you have the ability to run sudo,
3045000	3049140	because you can run sudo, and you have the user's credentials.
3049560	3053060	So, you can use, in this example, the expect command.
3054280	3058060	And the expect command basically simulates user interactivity.
3059720	3063200	And command, you know, on the man page, this is alphabetically,
3063200	3067580	but there's always, there's four of them that you would practically really need to know
3067580	3069760	in order to run this example.
3070680	3074220	Spawn, which spawns the command of whatever you supply.
3074540	3077300	Send is providing input to standard input.
3078180	3082700	Expect parses, I think it does both standard out and standard error.
3083020	3085480	I haven't tested that, but I think it does.
3085480	3087540	It does both, at least does standard out.
3087540	3089980	And then, you got interact.
3090300	3094940	And then, that basically goes hands-on at that point.
3094940	3098940	It's kind of like, if you ever used potent tools with Python, right?
3098940	3102560	It's like the interactive, similar kind of mentality there.
3103600	3106080	And so, I'll break this down.
3106080	3108540	Expect C, you're supplying the command.
3108540	3110980	You then spawn sudo S.
3111040	3114000	So, it's kind of like a spawn, the spawn, the spawn thing, right?
3114000	3119440	Sudo S, in this case, we're just going to read root.txt.
3120040	3122340	We spawn that process.
3122340	3126880	We then look for, with globs, it supports globbing too.
3126880	3128860	So, you don't have to be exact exactly.
3128860	3132940	You can, a little bit of wiggle room when you're doing your expect.
3132960	3138200	We look for password, because that's typically what you see whenever you're prompted by sudo.
3138240	3141000	We will provide the password,
3141760	3145100	which, in this case, it's always the username, because for demo examples,
3145560	3148120	you do have to provide your own enter,
3148120	3150220	and then you interrupt.
3151460	3153300	So, demo.
3156390	3157790	Okie dokie.
3160880	3164280	And this one will require a limited shell.
3164280	3166380	It will require a reverse.
3168320	3170600	These ones, three, four, five.
3171320	3172600	I forget.
3175730	3176450	Okay.
3177910	3181850	So, in this case, I made a shitty little, didn't really make.
3181850	3183450	Oh, it's one, two, three, four. I'm sorry.
3184450	3185170	Four.
3186710	3187430	Okay.
3188270	3192210	So, it's a little crummy shell.
3192210	3193190	You can't do anything.
3193190	3194150	You don't have an environment.
3194150	3195550	There's no terminals, no nothing.
3195550	3196430	It's bare bones.
3196430	3201130	What you might see, if you're doing a CTF, a real pen test,
3201130	3203070	where you don't actually have functionality,
3203070	3205490	you know, it's a limited shell, it's a limited shell,
3205490	3207310	it's a limited shell, right?
3207310	3211050	You got nothing, really, per se.
3211050	3213170	So, in this particular instance,
3215470	3221770	we can then supply the big glob that we had previously.
3222290	3223070	And so,
3224970	3226070	hit enter,
3226750	3228650	and there's our flag.
3235160	3236120	Okay.
3236720	3237360	So,
3238280	3240060	we're at the finish line now,
3240060	3241880	and this one's actually a pretty quick one,
3241880	3243580	and it's more recent, too.
3244860	3245740	This one,
3246360	3248800	it doesn't check for the existence of the user,
3248800	3250120	and so when it runs,
3251380	3254300	it executes with the arbitrary user ID,
3254300	3255960	and it returns a zero.
3255960	3259360	Zero is also root's ID, right?
3259760	3260940	And so, and then,
3260940	3262940	and that's executed for privileges,
3262940	3265180	or whatever you specify on the end of it.
3265180	3267340	And you test that out, too,
3267340	3269600	because if you specify,
3269600	3271840	see, in the as whom clause
3271840	3273940	of this user spec,
3273940	3275160	you can specify,
3275160	3278560	you can't run stuff as root, for instance.
3278860	3279480	Right?
3279480	3280640	And so,
3281680	3283020	this particular one,
3283020	3285000	I actually do need to copy and paste.
3285000	3287160	My username is
3288560	3289440	the,
3289940	3291420	it's not as intuitive.
3292240	3293120	Okay.
3293120	3295180	sudo l, right.
3295180	3297440	So, generally speaking, if I try to do anything,
3297440	3300340	either not as this particular application,
3300820	3302760	or if I try to do that,
3302760	3303680	but as root,
3303680	3305060	it's obviously not going to work,
3305060	3308480	because it is explicitly stated in the user spec.
3308480	3310160	However, given this particular
3310160	3312460	type of sudo,
3312460	3314940	you don't have to worry about that.
3315320	3316260	Right? And so,
3316260	3318600	let me get,
3318600	3320120	excuse me while I whip that out.
3320120	3320780	Okay.
3324810	3326270	So, yeah, you simply just do
3326270	3328510	sudo u,
3328510	3330190	and there's tons of scripts, too, where you basically
3330190	3332670	scrape the internet looking for this.
3333410	3334730	They're pretty nifty.
3334790	3336450	So, if I try to run anything
3336450	3338370	other than those two, you'll get prompted
3338370	3340710	by a password, which means
3341830	3342710	given that
3342710	3343970	there's no password, you see
3343970	3346630	it asking for password, you're wrong.
3346730	3348530	So, we'll just do id,
3348530	3350410	and we're root. We at least have the
3350410	3352570	root's uid. And if we do
3352610	3353530	a bash,
3354350	3355990	we are now root.
3356610	3358290	Okay. That
3358290	3360310	is good. So, a recap,
3360310	3362370	we covered sudo, sudoers,
3362370	3364430	we went through open,
3364430	3366070	sudo, we covered a bunch of easier
3366070	3367630	application stuff.
3368310	3370270	This is out of order a little bit.
3370270	3371490	Disregard it.
3372510	3374450	And so,
3374450	3376270	yeah, we covered a variety of things
3376270	3377910	from different angles,
3377910	3380190	from GTFO bins to some
3380190	3382510	CVEs from stuff from ExploitDB.
3382970	3384250	And just try to develop
3384250	3385750	the whole mindset that
3386350	3388330	you can really dig into sudo
3388330	3390470	and get creative and really have fun
3391610	3392790	with it.
3393850	3394310	And so,
3394310	3395810	I tried to cite as much...
3395810	3398150	I tried to cite everything that I could that I pulled
3398150	3400850	from, and I included that at the very end.
3401370	3402210	If you
3402210	3404170	happen to see your material featured in
3404170	3406030	here, and I did not
3406030	3408210	give you proper citation, just let me know
3408210	3410010	and I'll add it. I'm not
3410010	3412490	trying to plagiarize your stuff.
3412610	3414390	I try to give all
3414390	3416870	the citation credit where it is due.
3417590	3417890	And
3419070	3420790	that is my talk.
3427230	3427790	Okay,
3427790	3429750	do we have any questions?
3432070	3433630	I was trying to get
3433630	3435310	the mute button working, but
3435910	3437010	yeah, basically
3437890	3439710	first of all, thank you so much for
3439710	3441710	supporting us and for the great presentation
3441710	3443870	here. We're accepting questions
3443870	3445870	through Discord, and if you just
3445870	3447850	join us in the bottom of the screen,
3447850	3449830	there should be, whether you're on Twitch or
3449830	3451870	YouTube, there should be a link to our
3451870	3453910	website, and of course from there
3453910	3455690	you can actually get to our Discord
3455690	3457810	channel. So if you have any questions for
3457810	3459890	Tyler, please do so there.
3460430	3462210	We're going to go on a brief break,
3462210	3463830	and then the next presenter will start
3463830	3465830	in about 15 minutes. Thank you
3465830	3466010	again.