WEBVTT 00:01.040 --> 00:03.040 All right, we're back live. 00:03.100 --> 00:09.880 And thank you, Tyler, for supporting DEF CON, supporting the community, supporting the Red Team Village, in order to have you here. 00:10.040 --> 00:12.940 And with that said, without any further ado, take it away. 00:13.640 --> 00:16.780 Hey, good evening, late night DEF CON. 00:16.780 --> 00:18.440 This is 50 Shades of Pseudo-Abuse. 00:18.440 --> 00:21.100 I'm Tyler Boykin, and this will be my talk. 00:24.080 --> 00:26.620 So, we'll do a quick about. 00:27.040 --> 00:31.560 And the intended audience level for this kind of thing is beginner to intermediate. 00:31.560 --> 00:34.980 And there's plenty of talks on some whiz, some cool advanced stuff. 00:34.980 --> 00:39.740 But I figured we'd keep it in the beginner-intermediate range. 00:39.740 --> 00:44.640 Or if you're a more seasoned professional, you may pick up a few things, maybe a good refresher. 00:44.720 --> 00:53.560 We'll do a brief crash course on Pseudo, on where it stands on the TTP, the MITRE realm of things. 00:53.560 --> 00:55.860 And then we'll cover the Pseudovers file. 00:55.860 --> 00:59.360 And then we'll hit up some enumeration and recon. 00:59.840 --> 01:03.260 And then we'll go into the fun stuff, which are all the examples. 01:04.720 --> 01:07.200 So, a little bit about me. 01:07.200 --> 01:10.500 I'm an Aggie communications officer with the Marine Corps. 01:10.880 --> 01:14.300 Cut my teeth with network engineering and information assurance. 01:14.300 --> 01:18.460 And then now I do security engineering for BioLite Professional IT Services. 01:18.700 --> 01:22.000 And so you can find me on Twitter and a few other places. 01:23.120 --> 01:31.220 Okay, so superuserdo, whether you're calling it pseudo or sudo, we're talking about the same thing. 01:31.640 --> 01:39.640 And it's basically, it allows any permitted user to execute commands as another intended user. 01:39.640 --> 01:43.880 Typically, 90% of the time, it's going to be approved. 01:44.360 --> 01:55.180 And the security policy, which is what we'll dive into as we're going into this, determines what privileges, what allocations, what all can that user do. 01:57.420 --> 02:11.820 And the whereupon authentication, specific tokens are made on the pseudo tracks, each and every failed or successful authentication. 02:12.000 --> 02:17.200 And it'll remember you for five minutes, so if you ever notice that, and then so on. 02:18.480 --> 02:29.980 And so when you execute a command, and you'll see this later on too, unlike su, as you were, the security policy just states which environment you get. 02:29.980 --> 02:35.940 So whenever you are actually running sudo, you inherit all of that users in full environmental variables. 02:35.940 --> 02:41.520 For instance, you get the, unless it's explicitly stated otherwise. 02:41.520 --> 02:43.820 So you typically get their environment variables. 02:43.820 --> 02:47.740 You'll get a variety of IDs, right? 02:47.740 --> 02:51.340 And unless you specify otherwise. 02:51.540 --> 02:55.080 Real effective user IDs, group IDs, right? 02:55.080 --> 02:58.700 You get a good variety of things up there. 02:58.700 --> 03:00.800 But it's as the target user. 03:02.820 --> 03:05.920 And these are straight out of the sudo man pages. 03:05.920 --> 03:11.940 I'm just going inch deep, mile wide stuff, just to kind of give a little bit of a background. 03:11.940 --> 03:15.020 There is no easy way, right? 03:15.020 --> 03:17.000 There is no easy way. 03:17.060 --> 03:28.240 And this is to prevent a malicious user from escalating, abusing stuff if stuff is allocated. 03:28.240 --> 03:32.140 Simply because there's a whole breadth of things. 03:32.300 --> 03:39.480 There's this breadth of applications and features that can be manipulated maliciously. 03:39.480 --> 03:42.620 It gets rather hard. 03:42.840 --> 03:46.000 And so, I mean, there are ways to mitigate this. 03:46.000 --> 03:54.980 You force, at least you really crank down on the least privileged kind of method of security and whatnot. 03:54.980 --> 03:59.880 But it's really, you have to be particularly stingent when allocating stuff. 04:00.480 --> 04:04.640 Okay, so we'll kind of shift gears here into Mitre. 04:05.100 --> 04:09.000 And so it falls under abuse elevation control. 04:09.000 --> 04:11.340 So this shouldn't be anything new, right? 04:11.340 --> 04:17.580 This is pretty similar vernacular to what we've been talking about the past couple of minutes. 04:18.140 --> 04:25.880 Adversaries may circumvent mechanisms designed to control and elevate privileges to higher level and so on. 04:25.880 --> 04:34.040 And so where the sudo and the sudoers falls into is now the new format, which they went to sub-techniques. 04:34.220 --> 04:37.020 And I'll give you all a quick minute to read that. 04:37.020 --> 04:38.460 I think I've got it. 04:38.880 --> 04:40.260 No, I'm just kidding. 04:40.860 --> 04:44.080 So basically it says the same thing. 04:44.120 --> 04:51.460 Adversaries may perform sudo caching, and that's to where they go after those token files. 04:52.060 --> 04:58.800 And so in the directory, each user that attempts to authenticate via sudo gets their own specific directory. 04:59.180 --> 05:02.380 And then each attempt has its own little file. 05:02.380 --> 05:03.400 It's kind of cool. 05:03.400 --> 05:14.940 And then adversaries may attempt to abuse the caching or misconfigurations in sudoers, and that is where you'll actually wind up seeing 05:18.600 --> 05:23.620 a lot of the stuff for all this talk are mostly out of sudoers misconfigurations. 05:25.400 --> 05:28.320 Okay, and that's a good segue. 05:28.320 --> 05:35.240 So sudoers is the primary configuration file when you're working with sudo. 05:36.200 --> 05:38.360 It resides in Etsy. 05:38.620 --> 05:42.880 Technically, you can edit it with whatever you want to. 05:42.880 --> 05:47.820 That is not encouraged because it is very syntax picky. 05:47.920 --> 05:52.320 So generally speaking, you make a copy of it and you use visudo. 05:52.800 --> 06:01.440 And if you use visudo to edit the file, it'll run the error checking, the syntax checking immediately upon exit. 06:01.460 --> 06:07.940 Or you can just, let's say, if you wanted to tweak something, mess with something, you can always just run the standalone checker on the file. 06:15.270 --> 06:17.650 So that's what it's basically going to look like. 06:17.650 --> 06:19.150 You're going to have... 06:21.450 --> 06:25.470 If you make a misconfiguration anywhere in sudoers, it'll yell at you. 06:25.470 --> 06:27.250 Like that. 06:27.310 --> 06:31.250 And then if you're good, then it tells you, okay. 06:34.030 --> 06:39.970 So the sudoers specifies the who, what, when, where. 06:40.030 --> 06:41.670 It's the be-all, end-all. 06:41.670 --> 06:46.130 Other documents contribute to this whole security order, this whole policy. 06:46.130 --> 06:52.270 But the main point of configuration is sudoers. 06:52.270 --> 07:00.170 And so unlike... by default, password authentication is required, but you can specify no password. 07:00.310 --> 07:07.350 But unlike su, where you authenticate as the user which you are trying to do stuff as, so let's say root. 07:07.350 --> 07:10.190 You authenticate as root. 07:10.230 --> 07:16.350 Sudo, using sudoers, you authenticate as the user calling it. 07:16.350 --> 07:19.450 And so it's a little bit less. 07:20.710 --> 07:23.850 And so the file is composed of two main parts. 07:23.850 --> 07:25.970 It has some other sections, too. 07:27.890 --> 07:30.950 And you can go into a little bit more detail about that. 07:30.950 --> 07:38.030 But for the purposes of what we're doing here, you're going to have your aliases, which are kind of like variables and placeholders. 07:38.610 --> 07:45.070 And then you have your userspecs, which are the five Ws. 07:45.090 --> 07:47.990 And there's quite a few userspecs for these examples. 07:50.010 --> 07:55.370 And so when multiple entries stack up, they're applied in order. 07:55.510 --> 07:57.270 You see that a lot in userspecs. 07:57.270 --> 08:01.310 And then if there's... and then it racks and stacks into the last one. 08:08.320 --> 08:10.000 So, aliases. 08:10.120 --> 08:13.920 The interesting thing is that these syntax on the man pages are actually a little less... 08:13.920 --> 08:17.940 When you see them in a sudoers file, it kind of makes sense because stuff, right? 08:17.940 --> 08:20.020 But the format kind of eh. 08:20.020 --> 08:22.400 But essentially, it's alias type. 08:22.400 --> 08:23.660 Name. 08:23.660 --> 08:26.740 And then you go on and you can specify whatever you're trying to alias. 08:26.740 --> 08:30.080 And then you have your defaults that you can always set to. 08:31.720 --> 08:34.200 And so, moving on a little bit. 08:34.200 --> 08:39.820 The sudo allows for shell-style globs and wildcards. 08:39.900 --> 08:47.520 It's not actual regex, but if you've ever done anything in bash or shell or whatever, it's similar in functionality. 08:47.840 --> 08:51.360 An asterisk is one or more. 08:52.020 --> 08:55.000 And then question mark is any single character. 08:55.300 --> 09:01.900 You can kind of do range, kind of splitting between brackets and so on. 09:01.900 --> 09:07.400 But this isn't... it's not actual regex, but it functions similar to what you see in bash or any kind of shell. 09:09.840 --> 09:12.680 Okay, so we're down to the user specs. 09:12.920 --> 09:16.480 And this is actually a little bit more of the intuitive part, in my opinion. 09:16.540 --> 09:19.160 Because it basically... it's the who, what, when, where. 09:19.160 --> 09:20.720 You have the who, where. 09:20.720 --> 09:23.640 In the parentheses, you have the as whom. 09:23.700 --> 09:31.920 And you can use colons to delineate further detail into that. 09:31.940 --> 09:33.140 And then the what. 09:33.140 --> 09:39.880 And then sandwiched between the what are tag specs that kind of throw stipulations on some of the activities on how it's done. 09:39.880 --> 09:42.720 And we'll go into that with the next slide or two. 09:42.720 --> 09:45.700 And so the run as spec. 09:45.700 --> 09:48.000 So, for example, me at server. 09:48.240 --> 09:50.840 Me at host server. 09:51.100 --> 09:53.880 You know, as operator, these commands. 09:54.440 --> 09:55.780 It's not to the web. 09:57.280 --> 10:00.100 And so tag spec, and this is what I was talking about earlier. 10:00.100 --> 10:04.500 It sandwiches in between the as whom and the command part, right? 10:04.700 --> 10:13.860 And this can either greatly, drastically make a red teamer's life easier or it can make it a little bit more difficult, make it more complicated. 10:14.420 --> 10:18.280 No password, you'll see sometimes. 10:18.960 --> 10:25.220 Set in will also, you can deliberately manipulate the environment when you're calling those commands. 10:25.220 --> 10:32.460 And no exec prevents dynamically linked applications from actually calling shell on themselves. 10:32.460 --> 10:34.920 Or running commands themselves, you know. 10:34.920 --> 10:38.720 And we have an example of that later on also. 10:38.720 --> 10:41.760 But I'm going to hope for that no password. 10:42.160 --> 10:43.440 So much easier. 10:44.160 --> 10:46.880 Okay, so enumeration. 10:49.400 --> 10:50.960 So there's manually, right? 10:50.960 --> 10:52.300 You have sudo l. 10:54.080 --> 10:59.920 And if you're lucky, and this could be for any kind of real-world pen testing, CTFs. 10:59.920 --> 11:02.160 Could be for any type of thing, right? 11:02.320 --> 11:03.720 You have sudo l. 11:03.860 --> 11:05.480 And it might be as easy as that. 11:05.480 --> 11:08.000 The user that you may have compromised may be a sudoers. 11:08.000 --> 11:15.560 And when you do sudo l, you may get a listing of every, you know, what all that user can do, right? 11:15.560 --> 11:17.500 You have etcdoers. 11:18.380 --> 11:20.400 It should, hopefully it exists. 11:20.660 --> 11:25.260 If you can read it as an unprivileged user, I think there are bigger things going on. 11:25.260 --> 11:27.700 Or you're in a CTF, you know. 11:27.700 --> 11:32.560 But, I mean, that would help you help enumerate and get a bigger picture of things. 11:32.800 --> 11:37.100 In the event that you cannot, for instance, let's say you can't do sudo. 11:37.100 --> 11:40.200 But you're still trying to look at version numbers or whatever else. 11:40.200 --> 11:45.360 You can still get the version number from sudo with capital V and just do some googling. 11:45.700 --> 11:49.020 You know, maybe you can find a user or service that can't use sudo. 11:49.020 --> 11:52.140 And then you may be able to leverage that for exploitation. 11:53.080 --> 11:54.280 Etsy group. 11:54.280 --> 11:55.840 And so, same thing. 11:55.840 --> 11:59.860 You can see additional users that may be in, you know, the sudoers group. 11:59.960 --> 12:06.400 And then one of the places it logs is to var log or auth log. 12:06.400 --> 12:09.420 And so, that's all manual stuff. 12:10.340 --> 12:16.380 And generally speaking, because this is a subset of privileged escalation. 12:16.380 --> 12:22.540 So you don't need as much expansive tools and resources to really enumerate what you have, per se. 12:22.540 --> 12:25.180 You know, let's say if you're doing some other things. 12:25.260 --> 12:26.860 But there are automated things. 12:26.860 --> 12:30.420 For MSF, you know, you have post modules. 12:30.800 --> 12:32.840 I think the interpreter has a few also. 12:32.840 --> 12:35.500 And then there's some pretty well-known scripts, too. 12:35.500 --> 12:36.700 Like linenum. 12:36.720 --> 12:41.920 Anybody who's done CTLs and some other things has used linenum. 12:41.920 --> 12:43.940 That's a pretty well-known one. 12:44.040 --> 12:46.520 Follow sudo is actually pretty neat also. 12:46.520 --> 12:52.080 And I make another reference to the creators of that. 12:52.100 --> 12:56.540 And that particular one in the middle references that for that particular CVE. 12:57.400 --> 13:04.520 Okay, so examples. 13:05.360 --> 13:09.480 So this is from the creator, follow sudo. 13:09.480 --> 13:15.160 And this is more the degree of examples. 13:15.160 --> 13:17.900 Because it's kind of a spectrum. 13:17.900 --> 13:22.800 And I like to use the fruit, the hanging fruit kind of analogies. 13:22.800 --> 13:27.440 So the two examples, a complete lack of configuration. 13:28.000 --> 13:30.180 It's nothing wide open. 13:30.180 --> 13:31.680 It's low hanging fruit. 13:32.020 --> 13:33.360 That's the lowest hanging fruit. 13:33.360 --> 13:35.480 And you should go for the lowest hanging fruit first. 13:35.480 --> 13:37.140 Because those are the beginnings. 13:37.480 --> 13:39.120 Or you might see... 13:39.860 --> 13:43.600 They've tried to configure secure sets of rules. 13:43.600 --> 13:47.120 But there may be a bug in one of the applications. 13:47.420 --> 13:48.780 It may be something flagged. 13:48.780 --> 13:50.120 Or they just didn't know. 13:50.240 --> 13:52.300 But they're trying. 13:52.300 --> 13:57.840 Or it just may not be configured consistently throughout whatever they're doing. 13:58.180 --> 13:58.640 Right? 13:58.860 --> 14:05.740 Which is actually pretty normal for any other kind of real system hardening and whatnot. 14:06.420 --> 14:07.600 And you get the lowest of the fruit. 14:07.600 --> 14:08.820 You get the open sudo. 14:08.860 --> 14:12.860 And then you've got the top part, which is the fairly secure, as he's mentioning. 14:12.940 --> 14:17.800 But for today's purposes, we're going to be mostly residing mostly in the middle. 14:17.800 --> 14:19.420 You'll have a little bit of low fruit. 14:19.420 --> 14:22.500 And we'll have a little bit of the cool stuff up at the top. 14:22.500 --> 14:24.300 But the middle is going to be... 14:24.300 --> 14:25.620 That's where the fun playground is. 14:25.620 --> 14:28.880 Because it's a little bit gamier, in my opinion. 14:30.480 --> 14:31.200 Okay. 14:31.420 --> 14:36.520 So when you're doing this, you want to get creative and inventive. 14:36.520 --> 14:45.280 Because you don't necessarily have to get a fancy CVE, per se, with these. 14:45.280 --> 14:54.180 You don't have to make an alphanumeric fricking rock chain or anything like that. 14:54.180 --> 14:56.900 You're just using what exists creatively. 14:56.900 --> 14:58.560 And so that's kind of the cool part about it. 14:58.560 --> 15:00.800 And can you read something off limits? 15:00.800 --> 15:02.140 Can you write to something? 15:02.140 --> 15:06.160 If you can write to something, then you can go really far then. 15:06.300 --> 15:06.800 Right ? 15:08.900 --> 15:11.700 This is where you're scouring the man pages. 15:11.700 --> 15:14.700 And you're looking for flags. 15:14.700 --> 15:17.500 You're looking for little subtle things that may be kind of useful. 15:17.500 --> 15:19.900 And that's why it's more fun. 15:20.360 --> 15:23.760 And it's kind of a misnomer, escalate laterally. 15:23.760 --> 15:25.440 You may be able to move laterally. 15:25.440 --> 15:32.540 I haven't really seen any non-root users specify in sudoers. 15:32.540 --> 15:33.460 But that's an option. 15:33.460 --> 15:35.460 You can do sudo as a different user. 15:36.980 --> 15:40.420 But using that gets you to a different user. 15:40.420 --> 15:43.940 I mean, that's worth mentioning on a pin test report. 15:43.940 --> 15:46.500 And that may get you to something bigger and better. 15:46.500 --> 15:48.540 It's not always about up and down. 15:48.540 --> 15:50.040 Sideways works too. 15:50.260 --> 15:50.860 Right ? 15:52.060 --> 15:58.360 And so with that, we are now entering low-hanging fruit. 15:58.900 --> 16:00.840 So this is the easy stuff. 16:00.840 --> 16:03.260 Open sudo, the classic example. 16:03.260 --> 16:08.320 Wide open, user authenticates as himself, his or herself, whatever. 16:08.320 --> 16:12.060 And then the system is their oyster. 16:12.060 --> 16:15.100 Their one step, their keystrokes away from root. 16:16.160 --> 16:18.780 And so you go into a little bit more. 16:19.200 --> 16:30.120 So these, any applications that directly result in a shell, they're pretty much right next to there. 16:30.220 --> 16:34.080 This is your SH, KSH, ZSH, whatever, right? 16:34.080 --> 16:35.200 SU. 16:35.200 --> 16:42.080 And any actual programming languages too, because those can, again, cough up shells. 16:42.420 --> 16:44.760 Cough up shells, cough up functionality. 16:46.260 --> 16:48.780 Those are pretty big gummies. 16:51.060 --> 16:54.280 And so then we go, this is kind of like a little bit higher. 16:54.280 --> 16:59.220 We're turning up the volume on the creativity a little bit, right? 16:59.220 --> 17:04.340 And so you've got commands, right? 17:05.180 --> 17:11.640 And so you're not, they don't give you, they can give you instant shells, but it's not right off the bat. 17:11.640 --> 17:13.540 So you've got to dig for stuff a little bit. 17:13.540 --> 17:15.080 And you have to use stuff unintended. 17:15.620 --> 17:17.780 You've got to think outside the box. 17:18.200 --> 17:21.580 And so that's why I think, that's why I kind of like some of these. 17:22.100 --> 17:23.620 And so here are a few examples. 17:23.620 --> 17:25.680 When you do wget, right, for instance. 17:25.680 --> 17:34.900 If you supply I as an input file, it'll attempt to read each line in that file as its own URL and it'll attempt to shoot it. 17:34.900 --> 17:38.940 So if you do sudo wget whatever, say Etsy shadow, right? 17:39.060 --> 17:44.880 Each line of Etsy shadow is going to be, wget is going to try to resolve or make a request to each line of Etsy shadow. 17:44.880 --> 17:48.540 I mean, it'll fail, but that's file read, right? 17:48.640 --> 17:52.300 You're now reading sensitive files that you're not supposed to. 17:53.340 --> 17:55.160 And same thing with curl. 17:55.660 --> 17:57.420 And this one's actually kind of cool. 17:57.420 --> 18:00.400 These are two web request applications. 18:00.720 --> 18:04.380 And you don't even have to make an actual web request for them, really. 18:05.220 --> 18:06.600 So it's kind of neat. 18:06.600 --> 18:08.240 And so you continue to offset. 18:08.900 --> 18:12.020 And then it'll automatically find where to resume. 18:12.020 --> 18:16.920 And you basically specify the remote name, which is local. 18:16.920 --> 18:18.580 And so then you specify file. 18:18.580 --> 18:31.500 It actually accepts in this format here, file, kind of like you're doing FTP or whatever, or HTTP, the location on the local system. 18:31.500 --> 18:36.760 And it'll download it and you can read it. 18:36.760 --> 18:38.160 It's actually pretty neat. 18:39.420 --> 18:41.800 Base64 is another interesting sample. 18:41.800 --> 18:42.640 That's file read. 18:42.640 --> 18:44.060 I think that's file write also. 18:44.060 --> 18:45.280 I'll have to double check. 18:45.280 --> 18:50.100 But essentially, you're looking at, it's file read. 18:50.100 --> 18:54.480 And if you pipe it into itself and supply the D flag, you have the clear text. 18:54.560 --> 18:56.320 You have it on 64. 18:57.600 --> 19:06.520 And then GCC, if you supply wrappers, it'll run the command that you supply. 19:06.520 --> 19:12.560 And all params are passed comma separated after the initial command. 19:14.020 --> 19:17.020 And then at the very end, we're tagging along. 19:17.020 --> 19:22.140 Let's say you have kind of a bug or like a big, gaping kind of bug thing. 19:22.460 --> 19:29.810 And it's kind of a mix between the high level and low level. 19:30.120 --> 19:36.480 But any bugs that are incurred at sudo are going to have sudo consequences also. 19:36.480 --> 19:42.120 So, where's my demo thing? 19:42.120 --> 19:42.780 Okay. 19:42.900 --> 19:47.820 So, we will do some shell time. 19:47.820 --> 19:48.800 How about this? 19:49.180 --> 19:53.240 So, L, section one, open sudo. 19:53.240 --> 19:56.000 So, yeah, sudo L, right? 19:56.000 --> 20:00.780 Anything, you do sudo su cat root text. 20:00.780 --> 20:01.560 That's what it looks like. 20:01.560 --> 20:05.420 That's what I'm using for these particular purposes. 20:05.420 --> 20:08.400 Looks like that kind of jazz, right? 20:11.260 --> 20:17.160 So, apps, sudo L. 20:17.460 --> 20:19.780 And so, this is pretty much the same thing too. 20:19.800 --> 20:23.460 If you run sudo is in the top two, you're going to get an instant shell. 20:24.080 --> 20:31.900 Creatively, I think the kind of neat one and one that you can use for if you're working, trying to get a non-limited shell is with the Python. 20:31.900 --> 20:40.170 And so, Python, most interpreted kind of languages and some things, except inline commands, correct? 20:40.720 --> 20:49.060 So , pity spawn, pity the fool, bash, right? 20:49.060 --> 20:50.360 And so then your root. 20:51.120 --> 20:53.960 It's pretty cut and dry. 20:54.000 --> 20:56.200 It was pretty straightforward. 20:56.760 --> 21:00.940 So, now we're getting into a little bit more fun stuff with wget and whatnot. 21:02.060 --> 21:10.560 So, if you notice, it accepts an input file. 21:10.560 --> 21:16.450 And so, basically, that's what it looks like. 21:16.450 --> 21:20.110 It tried to run the flag in our particular case. 21:20.490 --> 21:25.890 It tried to make a request to it and obviously it's going to fail because it's nothing, right? 21:26.270 --> 21:31.430 And so, that was pretty neat when I first learned that, right? 21:31.430 --> 21:34.990 And so, base64, similar thing. 21:35.930 --> 21:43.830 It comes in as you're basically piping it to itself and you're specifying the D, which means decode. 21:46.570 --> 21:49.710 So, here we go. 21:51.390 --> 21:53.730 Wrapper, we have got root. 21:54.590 --> 21:56.270 It ran sh. 21:58.090 --> 22:02.230 And then, lastly, for this little bit, curl. 22:02.230 --> 22:07.670 So, it literally downloads and the spot into the local directory. 22:10.110 --> 22:11.650 We've got the flag. 22:12.970 --> 22:14.930 Bada bing, bada boom. 22:15.470 --> 22:22.430 And so, in this particular instance, it's just a small program, say, mycat, right? 22:22.430 --> 22:23.730 Just to show an example. 22:23.730 --> 22:35.450 Obviously, and didn't mention this before, but as we progress along, you'll see a common trend of applications having more than one exploitation vector, right? 22:35.450 --> 22:38.210 So, it may not just be file read. 22:38.210 --> 22:39.490 It may can do file write. 22:39.490 --> 22:42.950 It may be able to do commands, right? 22:42.950 --> 22:49.010 It just depends on how you work it and whatnot. 22:49.010 --> 22:57.130 And so, in this particular case, it basically takes in through standard input and sends that to system, right? 22:57.130 --> 23:00.110 So, there's two, at least two with this one. 23:00.110 --> 23:06.630 So , I do sudo mycat, do root text, write file read, sensitive file read. 23:06.630 --> 23:13.930 You can also write bin sh, get root. 23:13.970 --> 23:18.010 Typical string exploitation. 23:21.890 --> 23:23.010 Okay. 23:24.890 --> 23:27.210 Okay, now we're going to get a little bit fun now. 23:27.210 --> 23:28.950 So , pager abuse. 23:31.510 --> 23:33.910 Okay, those got mixed up. 23:33.910 --> 23:35.150 Okay, so pagers. 23:35.150 --> 23:47.410 So, whenever you run man or service or any kind of terminal editor, and those things where you can scroll up, down, left, right, it's called a terminal pager. 23:47.970 --> 23:53.490 And the interesting thing is that people know what it is, but they don't know what it is per se. 23:53.510 --> 23:57.850 But it's basically what happens behind the scenes is a terminal pager gets called. 23:57.850 --> 24:04.710 And they accept extra commands. 24:04.710 --> 24:12.730 When you supply an exclamation mark, anything proceeding that exclamation mark gets run as a command. 24:14.070 --> 24:18.150 So, your editors, you know, vim, nano, etc. 24:18.610 --> 24:21.190 And so, yeah. 24:21.190 --> 24:23.630 We'll go ahead and show that right quick. 24:23.630 --> 24:33.010 Like, l, section2, pagers, if I can type, 24:36.540 --> 24:37.120 l. 24:37.620 --> 24:43.340 So, yeah, if I do sudo man man, quick example, we're now in a terminal pager. 24:43.580 --> 24:45.740 You can go up, down, left, right, whatever. 24:45.740 --> 24:50.380 By simply just typing stuff, it'll start parsing your input. 24:50.380 --> 24:55.580 And by doing exclamation mark, everything after this will be run as a system command. 24:55.580 --> 25:00.360 So, vim sh, we're now root, etc. 25:02.740 --> 25:05.700 Same thing with service, too. 25:05.700 --> 25:10.100 So, sudo service blank status. 25:10.100 --> 25:11.920 I'm going to get all of them. 25:11.920 --> 25:13.860 I'm going to open up a pager. 25:17.260 --> 25:20.760 vim sh, easy peasy. 25:20.760 --> 25:26.200 And so, a neat thing is you tend to forget these types of things. 25:26.200 --> 25:30.280 But let's say you do a service, but it doesn't have that much output. 25:31.700 --> 25:34.360 It's more just kind of terminal fundamentals, perhaps. 25:34.500 --> 25:36.640 Let's say you do cron status, right? 25:37.600 --> 25:41.000 And actually, it does do a pager right there, midway. 25:41.020 --> 25:49.140 But for whatever reason, if the pager ends prematurely, let's say it finishes, you can always just shrink your freaking terminal down to like here. 25:49.600 --> 25:56.040 And then do it again, and it'll open up the pager for you. 25:56.220 --> 25:57.620 So, I think that's kind of neat. 26:05.820 --> 26:08.140 Yes, GTFO bins. 26:08.140 --> 26:09.920 A lot of these are on GTFO bins. 26:09.920 --> 26:13.880 Now, I tried not to just go down and just start listing them off. 26:13.880 --> 26:15.780 I tried to grab a variety of different things. 26:15.780 --> 26:23.040 So, yeah, GTFO bins is definitely very, very handy. 26:23.040 --> 26:27.620 If you're not using that, you're definitely crippling yourself in what you can do. 26:28.060 --> 26:29.480 Okay, cron abuse. 26:29.620 --> 26:31.680 So, this kind of goes without saying. 26:32.320 --> 26:44.760 If you can edit, you can manipulate or run or do any kind of service type things as root, that's going to have root-like implications. 26:45.620 --> 26:50.560 And so, that's a pretty short slide. 26:51.040 --> 26:59.120 But , so, sudo l, or s-u-l, sorry, section 3, cron l. 27:00.420 --> 27:13.880 Yeah, and so in this particular instance, right, and so it's actually worth noting that if you do cron tab, if you haven't done it before in the system, and you don't have the right environmental variables set, what's the first thing it asks you? 27:13.880 --> 27:17.180 It asks you, what editor would you like to use? 27:18.000 --> 27:26.880 And so then you have editor-style exploits with whatever kind of services you can do also. 27:28.480 --> 27:33.060 So, in this particular case, sudo l. 27:33.280 --> 27:48.160 So, let's do sudo cron tab e, and I already have something set up, but now we're in Vim, right, so any kind of root, easy peasy. 27:48.240 --> 27:56.600 But, it's also the implication that you can edit the root's cron tab and run stuff as root, any kind of services. 27:56.600 --> 28:07.720 In this particular case, I have this little script here, and all it does is, just for the example, it basically reads in root text and writes it to the current directory. 28:07.720 --> 28:10.820 It's pretty easy peasy. 28:10.820 --> 28:15.760 So, sudo service cron start. 28:18.610 --> 28:20.550 And you'd have to wait a minute. 28:20.730 --> 28:26.890 And let me see what's going on, on the Discord. 28:26.950 --> 28:27.790 Okay. 28:28.570 --> 28:38.470 So, at some point, probably in a minute, I might not just wait for it, but we'll see root text should hopefully populate up here. 28:39.810 --> 28:42.070 But, I don't think I'll wait for that. 28:42.630 --> 28:44.790 So, you'll just have to deal with it. 28:45.130 --> 28:47.950 Okay, so now we're getting into a little bit more fun stuff. 28:48.230 --> 28:50.030 LDPreload is actually kind of neat. 28:53.550 --> 28:56.970 And you need a bit of a background to understand what's going on. 28:56.970 --> 29:02.190 So, LDPreload, it's an exploit. 29:02.450 --> 29:09.210 You're using a feature that is intended to be used with dynamically linked binaries. 29:10.350 --> 29:19.830 Whereas, all the methods and all the stuff is resolved at runtime, whereas it's statically linked. 29:19.830 --> 29:27.870 You get that bigger file if you statically link everything, but you don't have to worry about shared objects being all messed up and whatever. 29:27.870 --> 29:31.370 You have everything in one nice big package. 29:32.230 --> 29:38.550 But, obviously, with dynamic linking, you do have a smaller file size. 29:38.550 --> 29:45.050 You have your typical libc and a bunch of other things to worry about. 29:45.050 --> 29:48.430 But, overall, it's a little bit more flexible. 29:49.910 --> 30:00.870 And so, with the LDPreload, you can essentially tell it to load that stuff before it loads the other stuff. 30:00.870 --> 30:09.330 And so, you can essentially overwrite any kind of method or function in whatever application you're running. 30:09.930 --> 30:14.310 And so, we need to put a few things together. 30:14.310 --> 30:19.670 You're combining a custom functionality with a binary that's being run as pseudo. 30:19.890 --> 30:22.130 And, obviously, that's going to equal fun. 30:22.210 --> 30:23.790 Pretty fun. 30:23.790 --> 30:26.890 And so, you'll see this in the environment. 30:27.150 --> 30:31.490 Whenever I've seen it, it's been in the environment. 30:31.650 --> 30:34.170 And the binary also has to be compiled for it. 30:35.350 --> 30:52.610 And so, the syntax for when you want to go about business with this, the pseudo LDPreload, you can export it to the env, to your environmental variables, or you can just run it all in one, like how we're about to do here in a minute. 30:53.650 --> 30:56.590 So, demo. 31:01.740 --> 31:06.240 So, L section for LDPreload. 31:07.880 --> 31:12.900 So, in this particular case, we can run the example. 31:12.900 --> 31:16.620 And I tried to cite, I got some of these examples straight off the internet. 31:16.620 --> 31:17.940 I tried to cite them. 31:17.940 --> 31:21.600 You can find these, I'll link to them, so if you want to look at them, reference them too. 31:22.300 --> 31:29.400 So, in this particular case, the example was, it runs a loop, and it prints 10 random numbers. 31:29.400 --> 31:33.700 It calls ran, and it outputs the standard out 10 numbers. 31:33.820 --> 31:46.880 So, in this particular case, because it's a dynamically linked, we can provide our own stuff, and we have the LDPreload environmental variable set. 31:46.880 --> 31:58.900 So, in this particular case, cat drandom, and basically, it's going to overwrite the rand function, and it'll just return 42. 31:59.120 --> 32:03.640 So, example C, right here, right? 32:03.640 --> 32:11.540 And so, you're basically going to, essentially, you're going to make that do what you want it to, which is kind of cool. 32:11.540 --> 32:13.920 So, for this particular example, 32:24.670 --> 32:44.750 So, sudo ldpreload drandom, shared object, to example. 32:44.750 --> 32:49.550 And, as you see, we basically made random do what we want to. 32:49.550 --> 32:50.550 So, it's no longer random. 32:50.550 --> 32:53.930 It just prints 10 42s instead of a bunch of actual random. 32:54.050 --> 32:59.890 So, taking that a step further, oh, we can manipulate the file as sudo. 33:00.070 --> 33:01.650 So, what do we do? 33:02.190 --> 33:04.310 We get evil. 33:05.550 --> 33:09.910 And, in this particular case, we're overwriting init, which happens right off the bat. 33:11.590 --> 33:15.330 And, you know, we basically pop shell. 33:15.830 --> 33:23.470 And so, using a similar type thing, evil, we are now rooted. 33:23.470 --> 33:24.430 It's pretty cool. 33:24.430 --> 33:30.370 And another cool thing is that it'll finish running the rest of the application once we exit. 33:30.370 --> 33:30.970 See? 33:30.970 --> 33:32.790 Because we only overwrote init. 33:32.790 --> 33:34.270 We didn't overwrite the rest of it. 33:34.270 --> 33:35.410 So, it's kind of neat. 33:36.010 --> 33:37.130 Okay. 33:42.610 --> 33:43.170 Okay . 33:45.090 --> 33:46.210 Installers. 33:46.250 --> 33:59.910 So, it goes without saying, right, that installing any kind of application is a security concern, especially if you're going to install it as admin, as root, any kind of privileged accounts, right? 34:00.150 --> 34:05.430 And so, these can definitely be leveraged in various kinds of ways. 34:05.430 --> 34:07.890 Pip, apt-get, dpkg, you name it. 34:09.330 --> 34:14.370 And so, for instance, a lot of these have multiple, let's say, apt-get and dpkg. 34:14.370 --> 34:16.550 They both invoke a pager. 34:16.790 --> 34:21.610 You can do stuff during install, providing custom functionality. 34:21.950 --> 34:28.750 For example, pip, when you're in setup, you can specify entire methods for doing stuff. 34:28.950 --> 34:31.090 It becomes your oyster. 34:31.090 --> 34:39.150 So, obviously, installing things as root is a big, critical security consideration. 34:40.950 --> 34:42.190 Okay. 34:42.190 --> 34:45.470 We will hit that up. 34:54.470 --> 34:58.090 Okay, so, sudo l. 34:58.970 --> 35:03.810 Okay, so, how does one make that a shared object? 35:05.970 --> 35:09.450 You compile and link. 35:10.110 --> 35:14.590 You basically don't do the full process when you compile. 35:16.210 --> 35:21.250 If somebody doesn't share that with you, we can grab that here after this. 35:22.070 --> 35:30.470 But basically, you make it a shared object, and it can be used by other dynamically linked applications. 35:33.150 --> 35:37.630 So, let me grab my thing real quick, y'all. 35:38.210 --> 35:45.050 Okay, so, for the pager, right, pager abuse, sudo apt-get. 35:45.900 --> 35:47.250 Not bad. 35:49.430 --> 35:51.090 Change log. 35:54.270 --> 35:56.990 See, we now have a pager. 35:57.250 --> 36:00.090 So, the old stuff still applies. 36:00.350 --> 36:09.150 And so, having that kind of mentality that, oh yeah, we're in familiar territory, it will help us for later on. 36:09.150 --> 36:16.970 And so, in this example, we have apt-get shell package. 36:16.970 --> 36:23.230 And all it's doing, you're basically providing custom functionality, and it runs at the very end. 36:23.230 --> 36:34.450 So, all you gotta do, you can specify, instead of making a normal web request out, you specify a local file for which to draw from. 36:34.450 --> 36:37.810 And then it basically goes like that. 36:39.150 --> 36:40.190 It's pretty cool. 36:43.620 --> 36:49.820 And the same thing with, when you go to setup, or setup, excuse me, pip. 36:49.980 --> 37:00.420 So , in this particular case, we have a setup py, like what you'd see in any, if you're installing any kind of module, any kind of thing written in Python or whatever, you'll have your setup py. 37:00.840 --> 37:05.340 And in this particular case, it actually does a reverse shell. 37:05.340 --> 37:09.080 And so, I'm gonna use, I need to split screen for a minute. 37:09.080 --> 37:15.150 I think that one was 1, 2, 3, 4, 5. 37:16.710 --> 37:19.210 So, 1, 2, 3, 4, 5. 37:19.210 --> 37:23.910 We do sudo pip install . 37:23.910 --> 37:27.290 to specify from the local directory. 37:28.290 --> 37:29.410 And we do. 37:30.210 --> 37:31.330 And we have. 37:31.810 --> 37:32.870 Bada bing. 37:33.730 --> 37:35.050 Pretty cool. 37:36.390 --> 37:37.050 Exit. 37:37.050 --> 37:38.070 Exit all out. 37:38.070 --> 37:39.250 All that jazz. 37:39.250 --> 37:40.690 Okay. 37:43.940 --> 37:45.280 Right on, right on. 37:46.860 --> 37:49.960 So, path and secure path. 37:49.960 --> 37:59.320 So, these, so if you recall back, right, globs and whatnot are acceptable within the sudoers file. 37:59.460 --> 38:03.960 The asterisk, star, whatever, is what are more? 38:03.980 --> 38:06.140 Question marks, new characters, and so on. 38:06.140 --> 38:12.360 So, and this is kind of in the same family as your normal environmental variable path, right? 38:12.360 --> 38:15.820 It's in the same vein of exploitation. 38:16.280 --> 38:22.840 If you see asterisks, you see stars in the sudoers file, you can have similar consequences, too. 38:23.160 --> 38:27.660 So, it's kind of similar in this particular case. 38:27.660 --> 38:35.320 Not exactly, but for example, if you see a dot, an emf, it's gonna read from the current directory first, wherever it's being invoked, and then it goes on. 38:36.560 --> 38:39.300 It goes on down the line, right? 38:39.300 --> 38:42.820 And if you see an asterisk, that means anything for that directory. 38:43.240 --> 38:45.880 And so, that's what's happening in this particular case. 38:45.880 --> 38:49.420 You know, anything in bin, you know, is free game. 38:49.620 --> 38:52.200 And so, obviously, that's not particularly secure. 38:52.840 --> 38:58.640 And so, interesting enough, for sudoers, right, you have the secure path. 38:58.640 --> 39:10.360 So, if you don't actually trust the environmental variables at the lower level to be well-formed or whatever, or to be secure, you can kind of override that with your own secure path. 39:10.700 --> 39:19.740 But obviously, if the secure path is misconfigured, that's fun for more than one person involved. 39:20.800 --> 39:29.440 So, and in this particular example, we made secure path temp to show that it's kind of a misconfiguration of sorts. 39:30.720 --> 39:36.200 So, l section6 path. 39:36.200 --> 39:39.240 I believe for this one, I'm doing the bin. 39:39.240 --> 39:52.220 So, and it's also worth noting, right, in other kind of privilege escalation mindset, that, you know, I can run anything in this directory. 39:52.220 --> 39:56.480 And so, as sudo, so you can basically write your own shell. 39:56.480 --> 40:00.740 You can do whatever, and it'll run what you want. 40:00.740 --> 40:04.300 So, in this particular case, I just made id, it runs shell. 40:04.400 --> 40:05.880 It's weird, but whatever. 40:05.880 --> 40:14.140 You know, and so, sudo, let me copy all that, I ain't typing that stuff. 40:14.180 --> 40:16.260 Boom, id. 40:20.900 --> 40:24.260 It's pretty intuitive. 40:24.400 --> 40:29.620 And then, sudo l. 40:29.760 --> 40:34.680 So, this particular one, it's going to check temp first. 40:34.680 --> 40:37.120 Because that's a misconfiguration on the secure path. 40:37.180 --> 40:38.040 And it's a particular one. 40:38.040 --> 40:41.260 And there's actually another exploit later on that utilizes double stars. 40:41.260 --> 40:43.300 But this is for the example, this purposes. 40:43.680 --> 40:46.620 You know, where is usually, where is ping usually at? 40:46.620 --> 40:49.140 Ping is usually user bin, right? 40:49.140 --> 40:58.580 But obviously, if we do sudo temp, and ahead of time, it's a temp to ping, right? 40:58.580 --> 41:05.100 You get the flag, because in that particular file, it does the same thing. 41:05.100 --> 41:07.080 It's just reading and printing, right? 41:08.060 --> 41:14.260 And so, that's just insecure path considerations when you're using globs and whatnot. 41:15.700 --> 41:16.440 Okay. 41:19.630 --> 41:23.830 So, we're getting there. 41:23.830 --> 41:24.790 We are getting there. 41:24.790 --> 41:26.210 Okay, so this one's kind of neat. 41:26.210 --> 41:28.330 So, editors and sudo edit. 41:29.150 --> 41:31.710 So, you have your obvious kind of blatant stuff. 41:31.710 --> 41:33.590 You already got your pager and whatnot. 41:33.590 --> 41:38.170 And anything with editors, you have file read, file write, any kind of commands. 41:38.170 --> 41:40.610 But how it does some things are kind of weird, right? 41:40.610 --> 41:48.730 And so, there's a few new things I stumbled upon while I was even making this in the past months. 41:49.990 --> 41:55.510 And we will include an actual CVE with this also, because it's kind of in the same line of things. 41:56.410 --> 41:58.310 And this is the actual CVE. 41:58.310 --> 41:59.910 It's on exploit DB. 42:01.410 --> 42:05.710 Sudo edit does not check the full path. 42:05.710 --> 42:07.150 So, if you use double globs. 42:07.870 --> 42:13.450 And so, the POC for this is you create a send link to anything sensitive, right? 42:13.470 --> 42:19.970 Anything sensitive, and it'll resolve that as correct, and it'll run it. 42:20.250 --> 42:21.630 And you're good. 42:21.810 --> 42:23.030 It's pretty cool. 42:23.790 --> 42:29.510 So, we will get to keyboard mashing. 42:29.990 --> 42:35.570 L, section, 7, editors, clear. 42:35.570 --> 42:37.050 Sudo l. 42:38.470 --> 42:39.530 Okay. 42:39.530 --> 42:41.910 So, we can do that one first. 42:41.910 --> 42:47.090 So, in this particular example, we have two directories. 42:47.990 --> 42:52.870 Test2 with protected, which is the actual symlink to it. 42:53.650 --> 42:56.250 It's going to Etsy Shadow right now. 42:57.270 --> 42:57.970 And then we have... 42:58.410 --> 43:00.850 Let me scooch that up a little bit for us here. 43:01.330 --> 43:02.270 There we go. 43:02.550 --> 43:02.970 All right. 43:02.970 --> 43:04.370 And so, var... 43:04.370 --> 43:06.030 I just made some dirs. 43:06.030 --> 43:06.870 And this one is... 43:07.510 --> 43:08.950 It's actually really nothing. 43:08.950 --> 43:10.690 I think it has some stuff on it. 43:10.690 --> 43:11.950 I forget what I put on there. 43:12.150 --> 43:18.750 But, either way, the user can't access either of them, because it does not have the permissions. 43:19.350 --> 43:19.590 All right. 43:19.590 --> 43:20.050 But... 43:20.050 --> 43:21.590 So, if I were to do... 43:22.870 --> 43:23.590 Sudo... 43:24.670 --> 43:25.990 Sudo edit. 43:25.990 --> 43:26.970 Right. 43:27.290 --> 43:28.590 And then specify... 43:30.990 --> 43:32.870 Test2 protected. 43:34.310 --> 43:35.750 Oops. 43:38.480 --> 43:49.220 So, it is worth noting that if you fat-finger something, you fat-finger it, it will ask you for a password. 43:49.220 --> 44:03.440 So, if you specify no password on a security policy, and whatever you're doing is prompting you for a password, then that action is not covered under the policy, and you're likely not going to be able to do it. 44:18.290 --> 44:19.630 Sudo edit. 44:27.600 --> 44:28.880 There we go. 44:28.880 --> 44:29.380 Okay. 44:29.380 --> 44:32.240 And so, now we are in anti-shadow. 44:32.880 --> 44:34.880 I must have been fat-fingering something. 44:35.920 --> 44:38.880 And so, this next example is actually kind of cool. 44:39.140 --> 44:41.840 So, we have this entry right here. 44:41.840 --> 44:43.000 No password. 44:43.240 --> 44:46.660 So, they're trying to lock us down to them, but they also have no exec. 44:46.880 --> 44:51.220 And so, if we recall what no exec is, it means no shells, or you can't run commands. 44:51.220 --> 44:53.420 You especially can't pop shells, right? 44:53.500 --> 45:01.940 And they are trying to lock us down to where we can only edit this particular file, which doesn't exist, but you can obviously open it. 45:01.940 --> 45:05.780 You can create the file and then save or do whatever in them. 45:06.300 --> 45:09.240 So, and we'll test that theory, right? 45:09.240 --> 45:11.700 Sudo them. 45:11.700 --> 45:14.100 Let's say we want to do root.txt, right? 45:14.220 --> 45:18.000 Can't do it because we're being prompted by password. 45:18.080 --> 45:23.700 Let's say if we use sudo them, and we actually do go to this. 45:28.470 --> 45:29.130 Right. 45:29.130 --> 45:32.350 So, obviously, and if we try to do our typical shenanigans, right? 45:32.350 --> 45:33.890 Nope. 45:33.990 --> 45:34.930 Denied. 45:34.930 --> 45:36.650 No shell for you, right? 45:36.650 --> 45:41.050 It's pretty cool, but here's a neat trick. 45:41.050 --> 45:47.510 You can source externally from within editors to doing your own stuff. 45:47.510 --> 45:51.770 So, colon E for edit, R for write, for read, right? 45:54.840 --> 45:55.920 Exactly. 45:56.280 --> 45:58.080 So, I think that's pretty neat. 45:58.080 --> 46:04.320 And then you can basically kind of wiggle around from inside, kind of like that. 46:06.120 --> 46:06.940 Okay. 46:07.320 --> 46:10.600 We are hooking and jabbing. 46:10.600 --> 46:13.240 We got a couple more, and then we are done-skies. 46:14.000 --> 46:15.140 So, PwFeedback. 46:15.140 --> 46:21.760 This one is an actual, this is also an actual CVE and has an exploit db entry. 46:22.560 --> 46:33.720 So, basically, in older renditions of sudo, it will ask you for your password, but when you supply stuff via standard input, it gives little stars. 46:34.040 --> 46:51.140 And, essentially, there is a stack-based buffer overflow, too much input through standard input, and you supply long enough of a string, you can then put in whatever malicious badness, goodness that you want. 46:51.140 --> 47:00.360 And it's actually a pretty simple exploit, and it's pretty simple to check out. 47:03.160 --> 47:06.060 And we will go ahead and do that. 47:07.480 --> 47:10.420 However, I need to see what user... 47:10.420 --> 47:11.580 One second. 47:12.380 --> 47:16.760 I need to get what I call these, because I don't call them all intuitive names, per se. 47:17.720 --> 47:18.660 Eight. 47:19.340 --> 47:20.560 Oh, that one is. 47:20.560 --> 47:22.120 Okay. 47:23.880 --> 47:26.260 Okay, pwfeedback, right? 47:26.280 --> 47:33.140 So, sudo l, in this particular case, we do need it this time. 47:33.760 --> 47:41.800 We do need it to prompt us for a password, so we can actually exploit, we can smash the stack, basically. 47:42.860 --> 47:48.920 And so, I have two POCs, and then I think once you can find it on... 47:48.920 --> 47:50.820 I think I'll link to at least one of these. 47:50.820 --> 47:52.760 They're pretty self-explanatory. 47:53.440 --> 48:01.140 So, this first one, it's 100 As terminated by a null, and it does this 50 times. 48:01.480 --> 48:08.200 And then after that, you can pipe in whatever commands you want, generally speaking, after the S. 48:08.200 --> 48:22.540 And so, for instance, if I were to do sudo, actually, POC, rear root, right? 48:22.540 --> 48:26.740 And notice in here, we're not actually supplying a password. 48:26.740 --> 48:28.940 It did ask us for a password, right? 48:28.940 --> 48:32.960 So, if we do sudo whatever, it asks us for a password, and we had to supply it. 48:32.960 --> 48:39.660 But because we smashed the stack, basically, and then supplied our own command, that's basically how we went out of business there. 48:39.660 --> 48:41.400 And the same thing with POC2. 48:42.340 --> 48:43.660 It's the same concept. 48:43.660 --> 48:45.200 It's just more fanciness. 48:45.200 --> 48:48.500 In that case, it does a reverse shell, like before. 48:48.880 --> 48:52.240 Okay, we have about 10 minutes left. 48:52.560 --> 48:53.800 I'm going to go ahead and... 48:53.800 --> 48:54.680 Yeah, we can do that one, too. 48:54.680 --> 48:55.420 Why not? 48:55.940 --> 48:56.940 Why not? 48:56.940 --> 48:58.620 Demux. 49:01.460 --> 49:04.500 This one was 3.4. 49:06.700 --> 49:08.460 POC2. 49:10.000 --> 49:11.760 Hmm. 49:11.760 --> 49:13.560 That's curious. 49:13.700 --> 49:15.560 Oh my god. 49:16.400 --> 49:18.800 Well, they all almost worked. 49:24.550 --> 49:25.690 Hmm. 49:25.750 --> 49:27.910 Might have to fuck with that later. 49:27.910 --> 49:30.550 But they'll get the general principle. 49:38.920 --> 49:40.240 Demo gods. 49:41.380 --> 49:41.920 So... 49:42.700 --> 49:43.780 Okay. 49:44.640 --> 49:45.860 Limited shells. 49:45.860 --> 49:47.480 This one's actually pretty neat. 49:47.480 --> 49:50.560 And I learned this, actually, by doing Pentester Academy. 49:50.920 --> 50:00.260 And if you're trying to look for different neat kind of ways to enhance your existing skill set, or learn completely new things, I highly encourage that. 50:00.260 --> 50:07.220 I'm not trying to show for Pentester Academy or BVIC, but he's a great instructor, and they have some great coursework. 50:07.220 --> 50:11.980 And so, in this particular one, just showing this particular example. 50:12.920 --> 50:15.700 And it's kind of a hypothetical, too, right? 50:15.780 --> 50:23.280 So, let's say you have a huge credentials. 50:23.860 --> 50:29.520 Normally, you would be able to do sudo as a user, but you do not have a full TTY. 50:29.680 --> 50:33.020 Let's say, for whatever reason, you can't make a full TTY. 50:33.020 --> 50:39.260 You can't do the SOCAT, the STTYRAW echo trick, all those normal things. 50:39.260 --> 50:40.820 Let's say those aren't working. 50:40.820 --> 50:49.140 But you still have a limited shell, and you have the ability to run sudo, because you can run sudo, and you have the user's credentials. 50:49.560 --> 50:53.060 So, you can use, in this example, the expect command. 50:54.280 --> 50:58.060 And the expect command basically simulates user interactivity. 50:59.720 --> 51:09.760 And command, you know, on the man page, this is alphabetically, but there's always, there's four of them that you would practically really need to know in order to run this example. 51:10.680 --> 51:14.220 Spawn, which spawns the command of whatever you supply. 51:14.540 --> 51:17.300 Send is providing input to standard input. 51:18.180 --> 51:22.700 Expect parses, I think it does both standard out and standard error. 51:23.020 --> 51:25.480 I haven't tested that, but I think it does. 51:25.480 --> 51:27.540 It does both, at least does standard out. 51:27.540 --> 51:29.980 And then, you got interact. 51:30.300 --> 51:34.940 And then, that basically goes hands-on at that point. 51:34.940 --> 51:38.940 It's kind of like, if you ever used potent tools with Python, right? 51:38.940 --> 51:42.560 It's like the interactive, similar kind of mentality there. 51:43.600 --> 51:46.080 And so, I'll break this down. 51:46.080 --> 51:48.540 Expect C, you're supplying the command. 51:48.540 --> 51:50.980 You then spawn sudo S. 51:51.040 --> 51:54.000 So, it's kind of like a spawn, the spawn, the spawn thing, right? 51:54.000 --> 51:59.440 Sudo S, in this case, we're just going to read root.txt. 52:00.040 --> 52:02.340 We spawn that process. 52:02.340 --> 52:06.880 We then look for, with globs, it supports globbing too. 52:06.880 --> 52:08.860 So, you don't have to be exact exactly. 52:08.860 --> 52:12.940 You can, a little bit of wiggle room when you're doing your expect. 52:12.960 --> 52:18.200 We look for password, because that's typically what you see whenever you're prompted by sudo. 52:18.240 --> 52:30.220 We will provide the password, which, in this case, it's always the username, because for demo examples, you do have to provide your own enter, and then you interrupt. 52:31.460 --> 52:33.300 So, demo. 52:36.390 --> 52:37.790 Okie dokie. 52:40.880 --> 52:44.280 And this one will require a limited shell. 52:44.280 --> 52:46.380 It will require a reverse. 52:48.320 --> 52:50.600 These ones, three, four, five. 52:51.320 --> 52:52.600 I forget. 52:55.730 --> 52:56.450 Okay. 52:57.910 --> 53:01.850 So, in this case, I made a shitty little, didn't really make. 53:01.850 --> 53:02.750 Oh, it's one, two, three, four. 53:02.750 --> 53:03.450 I'm sorry. 53:04.450 --> 53:05.170 Four. 53:06.710 --> 53:07.430 Okay. 53:08.270 --> 53:12.210 So, it's a little crummy shell. 53:12.210 --> 53:13.190 You can't do anything. 53:13.190 --> 53:14.150 You don't have an environment. 53:14.150 --> 53:15.550 There's no terminals, no nothing. 53:15.550 --> 53:16.430 It's bare bones. 53:16.430 --> 53:27.310 What you might see, if you're doing a CTF, a real pen test, where you don't actually have functionality, you know, it's a limited shell, it's a limited shell, it's a limited shell, right? 53:27.310 --> 53:31.050 You got nothing, really, per se. 53:31.050 --> 53:41.770 So, in this particular instance, we can then supply the big glob that we had previously. 53:42.290 --> 53:48.650 And so, hit enter, and there's our flag. 53:55.160 --> 53:56.120 Okay. 53:56.720 --> 54:03.580 So, we're at the finish line now, and this one's actually a pretty quick one, and it's more recent, too. 54:04.860 --> 54:15.960 This one, it doesn't check for the existence of the user, and so when it runs, it executes with the arbitrary user ID, and it returns a zero. 54:15.960 --> 54:19.360 Zero is also root's ID, right? 54:19.760 --> 54:25.180 And so, and then, and that's executed for privileges, or whatever you specify on the end of it. 54:25.180 --> 54:38.560 And you test that out, too, because if you specify, see, in the as whom clause of this user spec, you can specify, you can't run stuff as root, for instance. 54:38.860 --> 54:39.480 Right? 54:39.480 --> 54:45.000 And so, this particular one, I actually do need to copy and paste. 54:45.000 --> 54:51.420 My username is the, it's not as intuitive. 54:52.240 --> 54:53.120 Okay. 54:53.120 --> 54:55.180 sudo l, right. 54:55.180 --> 55:08.480 So, generally speaking, if I try to do anything, either not as this particular application, or if I try to do that, but as root, it's obviously not going to work, because it is explicitly stated in the user spec. 55:08.480 --> 55:14.940 However, given this particular type of sudo, you don't have to worry about that. 55:15.320 --> 55:15.480 Right ? 55:15.480 --> 55:20.120 And so, let me get, excuse me while I whip that out. 55:20.120 --> 55:20.780 Okay. 55:24.810 --> 55:32.670 So, yeah, you simply just do sudo u, and there's tons of scripts, too, where you basically scrape the internet looking for this. 55:33.410 --> 55:34.730 They're pretty nifty. 55:34.790 --> 55:46.630 So, if I try to run anything other than those two, you'll get prompted by a password, which means given that there's no password, you see it asking for password, you're wrong. 55:46.730 --> 55:49.750 So, we'll just do id, and we're root. 55:49.750 --> 55:51.850 We at least have the root's uid. 55:51.950 --> 55:55.990 And if we do a bash, we are now root. 55:56.610 --> 55:57.470 Okay. 55:57.730 --> 55:59.610 That is good. 55:59.610 --> 56:07.630 So, a recap, we covered sudo, sudoers, we went through open, sudo, we covered a bunch of easier application stuff. 56:08.310 --> 56:10.270 This is out of order a little bit. 56:10.270 --> 56:11.490 Disregard it. 56:12.510 --> 56:22.510 And so, yeah, we covered a variety of things from different angles, from GTFO bins to some CVEs from stuff from ExploitDB. 56:22.970 --> 56:32.790 And just try to develop the whole mindset that you can really dig into sudo and get creative and really have fun with it. 56:33.850 --> 56:35.810 And so, I tried to cite as much... 56:35.810 --> 56:40.850 I tried to cite everything that I could that I pulled from, and I included that at the very end. 56:41.370 --> 56:49.450 If you happen to see your material featured in here, and I did not give you proper citation, just let me know and I'll add it. 56:49.450 --> 56:52.490 I'm not trying to plagiarize your stuff. 56:52.610 --> 56:56.870 I try to give all the citation credit where it is due. 56:57.590 --> 57:00.790 And that is my talk. 57:07.230 --> 57:09.750 Okay, do we have any questions? 57:12.070 --> 57:22.590 I was trying to get the mute button working, but yeah, basically first of all, thank you so much for supporting us and for the great presentation here. 57:22.670 --> 57:36.590 We're accepting questions through Discord, and if you just join us in the bottom of the screen, there should be, whether you're on Twitch or YouTube, there should be a link to our website, and of course from there you can actually get to our Discord channel. 57:36.770 --> 57:39.890 So if you have any questions for Tyler, please do so there. 57:40.430 --> 57:45.250 We're going to go on a brief break, and then the next presenter will start in about 15 minutes. 57:45.310 --> 57:46.010 Thank you again.