Hey everybody and welcome to next video we're gonna be going over file permissions now.
File permissions are important to understand unbolt the Windows and Linux side.
There are a lot of issues that are a lot of times admins will open up a file a little bit or directory
more than they should just for getting things done pretty quickly and then forget to change them back
later and being able to identify where you have access and where you don't is important is important
skill set.
So with this example on the Linux side we're gonna be looking at we've we've gained access to a guest
account.
So if we take a look here the guest account is just a guest and in groups GUEST There's nothing special
with it.
Pseudo dash l there is no no sudo access for this user.
So the password for guest as guest will use that as an example.
But there's no access to the user or there's no access to anything that we can see now.
No easy wins that we're gonna be able to find but knowing how to search for what we have access to is
a unique skill set.
But I'm going to show you guys how to search for worldwide able directories.
This means any user can access and right into this directory and we're gonna see how that kind of mixes
in with looking at different processes and identify what's running as a more appropriate user.
So the first thing we want to do is take a look at our process list.
So if we go ahead and look through this we can see here that we've got root on quite a few of them all
right.
We're not saying anything too useful everything looks pretty much the same of what we'd expect.
However what we do see here is that the Apache to instance is running as the first one is running his
route because that's required for it to open a socket.
But we can see it's running as admin instead of WW dash data.
Now w w dash that is the normal Apache user.
So this is use running as a different user then what we'd expect.
So we now know in the back of our heads that we have access to or the the Apache user is not the standard
of what we'd expect.
But let's ignore that for now and take a look at world readable directories which is always a good thing
to double check.
Where can you write overwrite.
Maybe it's over overlapping with a service that might be running his route or different user defined
world readable directories we're gonna use find we'll get us here find based on the route dash type
look for directories and the permissions we're looking for r o plus W and G plus W and we'll go ahead
and know the air so we don't get any and if we look here we see some common stuff like screen lock male
upload spool sessions temp is normal temp temp local share local Lib for Python that's fine but we see
here is we have a var BW dot or slash each team out.
So if we looked back at our script and patchy we can see that Apache is running as a different user
and currently we have a worldwide directory that looks like the Apache web route.
So if we go ahead and go into var w w w h.
You know we can see we can see we have a few files here so let's see if we can actually write to this
test stop BHP it looks like we can.
So Ellis of grep
or w e mail and see what has this open
looks like it's just a guess which is fine.
Normally that happens when nobody's actually serving up a web page.
Otherwise there's no reason for the Apache user or the process to be sitting inside of it.
So now that we we can readily assume that this is the Apache web route and what we can do is we can
actually test that.
So if we do a call request
to local hosts and we do this to test stop HB.
We don't get anything that's interesting.
So if we do lots of the ice just to make sure and we'll put in here working and we're going to shoot
that girl again.
We get working perfect.
So now we know that we can execute P HP or at least we can execute we can create a file in the web website
that we can load up on the web page that gets loaded up as that current user or whatever user patch
is running as in this case admin.
So let's see what we can do with that.
Let's go ahead and go into here.
Clear this out we'll do HP.
Zack let's do.
Who am I.
And I just kind of see what we're working with here.
So if we curl the same thing again Oh yeah.
We did not actually echo this out.
Try that again.
So we can see.
OK.
We are running as admin perfect so that's exactly what we would expect.
So what we can do is we can actually instead of echoing this out we'll just.
Now what we can do is we can actually tell this to go ahead and kick us back a shell.
So if we do that cat on local post.
Now keep in mind this machine happens to be on the same machine as the attacking machine.
In this case you would replace local host with whatever the your attacking machine is and we'll do port
ten thousand nine nine nine dash e bin bash.
So before we execute that we will go to our machine and let it and set up a net cat listener.
So this would be the attacking machine.
Go and execute that and we'll go out and.
And we see it sits which is good.
So if we do idea here that is exactly what we want.
So now that we have this what we're going to want to do is try to get our you know our sudo type prompt
so Python dash C import P T.
Why why does Von been
close that.
Perfect.
So now we've got a little bit of a prompt here to work with.
So we are currently I.D..
So let's see what they're pseudo rights are and.
OK.
We're not AB and they run the following and Kelly so it looks like we can just do pseudo dash you root
and bin bash boom.
Now we are rude.
So we went from abusing a file permission such as the web route on the web directory as we were able
to write to it as any user.
So because that admin user had pseudo rights we were able to take advantage of that week of file permissions
on the directory and move itself up to the admin user which is a form of privilege escalation on top
of that.
Then we took that a little bit more privilege user into creating our path to the root user on this system.
So what I want you guys to do is take a step and find out what find command you need to find out every
file and folder you have right access to as your current user.
So go ahead and take the time try to figure out what that what that command is and always keep that
in your backpack.
And the next thing we're going to do is take a look at a Windows machine.
So here we have a Windows machine.
Let's take a look at some file permissions here.
So if we go ahead and go to the computer we'll go to the C drive.
Right.
So if we take a look here we see our common stuff.
Let's try to go to guest accounts.
Desktop OK.
Nothing too fancy.
This is the account that we're on track go to user desktop.
Nothing there.
It's not too bad.
So but what we see here is this custom startup.
So that looks interesting.
So let's take a look at the Security permissions on this.
So administrators have full access of course the creator has.
Looks like special permissions system has full access.
The user account seems to have special permissions which is fine.
But what we see here is the users groups.
This is a group has full access to this path or this folder.
So we go in and go in here.
We have a read me custom FCP service.
Great.
So this is our FTE peels check permissions on this OK.
Perfect.
So we can see that folk fro control is part of this binary.
So if this binary if our our guest account user which is the user that we're on right now has no admin
access but it can override this FTB service.
This tells me that on start up some user or the system is going to execute this binary.
So what we can do is we can go ahead and build out a maternity show.
Go ahead start looking for will go in and kill us out and we'll do history
you will do it myself.
I we'll grab this one
go ahead and do this and we'll replace this with the correct IP and we'll do a dash F and we won the
XY so if we do DP daddy so we're going to just rebuild ourselves a reverse shell and if we go over here
we should have a handle already set up so we'll go in and run that that is exactly the same handler.
It matches this this payload and that's all.
So if we look in here we can see we have FCP Daddy XY so if we do Python simple HDP server maybe
we'll do 80.
That's right.
Dasha any perfect.
So let's go ahead and grab it.
Do TPD exceed
something.
Oh that's right we're poor.
Eighty eight.
That's right.
Perfect.
Good.
And save that.
Perfect.
Now let's see if we can go ahead and overwrite this.
Do we want to overwrite it.
Yes we do.
And it did not give us an error.
So this looks like our binary that we're kind of expecting.
So what we would need to do now is to just wait until the user either logs in or the machine restarts
or whatever the kick off is for this particular service.
So what I'm going to do since this is a simulated environment is I am going to go ahead and bounce the
machine so we can see what you what actually happens here.
So we'll go ahead and bounce the machine
perfect and we'll see we have Army interpreter show.
So if you go ahead and log in to show looks like we're in custom start up so we know our execute our
executable works correctly.
Oh let's see here.
Get you I.D..
Looks like we are the user and I believe this user has admin rights but just in case we do get system
just for shits and giggles.
So now if we do get your I.T. area we have a. system authority.
So we've abused a file permissions issue where it had and allowed anybody within the user's group to
modify this.
Anything in this folder.
And because of that use that application was being used in a startup service we were able to overwrite
that and find out what.
And be able to get a shell from that.
Now these are very very overly simply simplistic examples but the process is still the same regardless
of what service you're looking at or whether you're using deals or not.
Now we'll have specific videos over manipulating services and and working with deals at a more specific
way.
But this gives you just a general idea of what you can work with.
Now I want you all to do an additional bit of homework here.
There is a tool called Access check that would look for something like this.
I want you to take.
Go ahead and load up a Windows XP machine and use access check the tool should be available you should
be able to find it on Calleigh if not you can grab it from Microsoft's Web site so use access check.
I'll leave a link above the video for a tutorial for how to use as access check figure out how to use
it because it is going to save you so much time in the future.
It's a very very common tool to use especially when looking at windows permissions and finding out what
your user has access to and what it doesn't.
And also as an additional bit at the bottom of the video I've listed a few different ways to transfer
binaries on windows such as using bits easy to bash batch VB script FTB SMB.
Go ahead and take a little bit more time and figure out different ways to transfer or transfer binaries
from a Linux machine to a Windows machine and go ahead and test them out.
So it's important to have different ways to go about it.
I'm using just the web browser which is perfectly fine.
And as long as you have a web browser access such as you used a VNS inject payload to get a actual desktop
then you can always use the web browser pending any browser restrictions.
But assuming you're on the command line there's quite a few other ways to do it now.
And I want you to take the time and figure out all those ways and look at some additional ways past
that point.