[MUSIC PLAYING]
Welcome to the upgrading shells section of this course.
This is going to be a relatively short section in that we're
only going to have one video.
And this is the topic of the video
we're going to be exploring.
So in this video, we're going to be
exploring the process of how to upgrade noninteractive shells.
And this is pertinent to Linux postexploitation.
So throughout or up to this point in the course,
we have exploited a few Linux systems.
And one of the things you might have seen
is that we, in some cases, have obtained a command shell
session, right?
And the command shell session was a little bit weird
because it didn't provide me with a prompt
or it didn't give me any indication as to
whether or not I can type in commands
or I'm interacting with the target system
that I've just compromised.
And in order to obtain a semi-interactive shell,
we typed in the command bin bash I, right?
And that provided us with a bash session.
And that, again, is an interactive shell.
So that was-- as I said, we've already covered it,
but I'm going to be explaining why you should actually upgrade
noninteractive shells and why they are counterproductive
and really aren't that useful.
And that's why I actually recommend this process.
So that is what we're going to be exploring in this video.
And as I said, this is not a problem
that affects Windows postexploitation.
This is really pertinent to Linux, all right?
So this video has a lab environment attached to it.
And what we're going to be doing is
we are going to start off by exploiting the target system.
Once we obtain the command shell session,
I'll then take you through the various techniques
that you can utilize to upgrade the noninteractive shell
into an interactive shell, all right?
So I'll be seeing you in the lab environment.
All right, so I'm back within the lab environment.
And in this lab environment, you'll
only be provided with a command line
interface, which is perfectly fine for what
we're going to be doing.
So the first step, of course, is to identify the target IP
address, which can be done by typing in the IF config command
and taking a look at the interface ethernet one.
And the INET value is what you want to copy.
So this is the IP address of the Kali Linux system.
The target IP address is always going to be--
or the target is always going to be the third IP
address on the subnet.
So just copy this value here.
In your case, it'll be different.
But just copy it and change the two at the end to a three,
all right?
So I'll copy that there.
Now, this target system is vulnerable
or has a vulnerable version of Samba running on it.
And this is a lab that we explored in the previous video.
So exploiting it can be done through the use of a Metasploit
framework exploit module.
So I'm going to open up MSF console here.
And we'll give that a couple of seconds
to start up, after which we'll set up
the global variable value for the Rhosts option.
So I'll say set G Rhosts, paste in the IP I copied,
and change the two to three.
And that's the target IP.
And the reason we are setting the Rhosts value
globally is so that whenever we load a Metasploit framework
module, the target IP address will already
be specified for us.
It's just a quick time-saving tip.
So I'll then say search samba, and we
are looking for the following exploit module.
So exploit Linux Samba is known pipe name, all right?
I'll copy that there, and I'll say use.
Paste that in there.
And I'll show the options here.
And you can see the target IP address is already specified.
And the target port is 445, which is correct.
So I'll type in exploit, and this will provide us
with a noninteractive shell.
And you'll actually see what I mean
when I say that it is really--
it really is noninteractive.
So again, this is not just limited
to Metasploit framework exploit modules.
A noninteractive shell can also be obtained through a Netcat
reverse shell listener.
So if you have ever exploited a Linux system, in some cases,
you may be provided with a noninteractive shell.
And one of the easiest ways to identify
that it is noninteractive is that it doesn't provide you
with a prompt.
So you can see that it tells me the command shell is opened,
but I really don't know whether I have access
to the target system.
And that's an issue, right?
However, it is a shell session-- a very basic one--
that can be used to perform very basic tasks and commands.
So I can say, for example, LS.
That will work out.
It's not displaying any output.
But if I type in PWD, that works out just fine.
Now, throughout the entirety of this course
till this point, what I was doing
is I was saying bin bash I, right?
And that would provide me with an interactive bash session--
although or albeit without any job control, which is something
we'll be exploring in another course.
But this is much better than having a noninteractive shell
session primarily because it provides me with a bash session
here, which is much more stable than a simple command shell
session.
And what I'll do now is-- let me just exit
from the bash session, and I'll take you
through a few techniques.
Now, before you start using any of the techniques
I'm about to highlight-- or what I was doing previously
was typing in bin bash I, that was without any context.
And I was doing that under the assumption
that bash was installed on the target system.
And this is something very important to actually realize
is that a Linux system does not need to have bash installed.
It could have the Bourne shell, which has bin SH, installed.
And in that case, you then need to modify or switch up
the technique you use to obtain an interactive shell.
So the first thing I recommend that you do
is display the list of shells that is installed on the target
system.
That can be done by cutting out the content of the etc shells
file.
In this case, it tells us that these are the valid login
shells available.
So we have the bone shell, we have dash, bash, and Rbash.
Now, based on these options, you can then
tailor what specific command to use.
Now, if bash is installed, then you can use bin bash I.
And one additional really cool trick or tip
is to identify what version of Python
is installed if Python is installed at all because
in addition to typing in bin bash I,
because the Bourne shell or bin is installed,
I can also type in bin SH I, and that
will provide me with a simple Bourne PowerShell session.
So again, and yes, this is somewhat interactive,
but bash is pretty much what you want in most cases.
So I'll just hit Exit.
And as I said, if you have Python installed,
then you can also obtain a bash session or a Bourne shell
if you want.
So the quickest way of identifying
whether Python is installed is by typing in Python version.
And if it is installed, then what you can do
is you can run the following command.
So you can see Python C. And then, in single quotes,
you can type in import PTY--
import PTY.
And this will allow us to spawn a PTY session.
So we'll say PTY.spawn.
And within this, we can then say--
or specify the shell that we would like to execute.
So I can say bin bash, and I'll close the quotes
and the actual brackets there.
And we can then, again, close the single quotes.
So be cognizant of the syntax.
If I hit Enter, you can see I also obtain a bash
session, which is fantastic.
So as I said, there's multiple techniques
that you can use to obtain an interactive session.
Now, the reason why I'm not covering
how to upgrade a command shell to a Meterpreter session
is because it's very simple.
And this video is directly targeted towards scenarios
where you've obtained a command shell session with Netcat,
right?
And in that case, you can't upgraded
to Meterpreter directly unless you generate
a payload with MSFvenom and then somehow transfer it
onto the target system, execute it, and then receive
the connection.
So as I said, it'll all come down to what
utilities or shells you have installed
in addition to the interpreters you have installed.
So if the Python interpreter is installed,
then you can use Python to spawn a bash session in addition
to a Bourne shell session or bin SH session.
And again, if you have Perl installed--
so if I type in Perl help--
if you have Perl installed, then what you can do
is I'll just exit, and I can then say Perl execute,
and then I can say exec in single quotes.
And within that, I can then specify in double quotes
that I want to execute bin bash.
There we are.
And then I'll add a semicolon and a single quote and hit
Enter.
And if this doesn't work, then, again, you
can see that is the case.
So you can see we're still within
our noninteractive shell.
So again, it all comes down to what techniques
you can essentially use.
Now, if Ruby is installed, you can also
say Ruby and then colon exec, and within single quotes,
you can say bin bash.
There we are.
And you can see that, in this case,
it looks like Ruby is not installed.
So again, it's all going to depend on what interpreters
are installed.
We can try, once again, with Perl.
Let's see if this will work because we
know that Perl is installed.
So I can say Perl exec, and we can then say bin bash.
And what I'll do here is I'll just close the quotes there,
and I'll just add a semicolon at the end.
And it looks like Perl, in this case, is not installed.
All right, so you learn something new every day.
But again, if that's not the case
or if you don't have these interpreters installed,
then you can utilize the actual shell commands.
So if we have bash installed, you
can say bin bash I. You'll then get a bash session.
You can also use Python if Python is installed,
and there's a plethora of other interpreters
that you can use to obtain an interactive shell.
Now, one additional thing that you want to check or do
after you have obtained an interactive shell
is to display the environment variables.
That can be done by saying ENV.
And in this case, you can see that we have a few issues here.
For one, the actual path environment variable
that is used to specify the default path that
will be used to search for a binary when you type
in a command is not specified.
So I recommend setting that up.
So this-- we can say export path is equal to user local sbin.
And then we can say colon.
And then we can say user local bin colon user--
we can say sbin in this case-- so sbin
and then colon user bin.
And I know that this is a long command,
but this is something that I really recommend that you do.
And then you can say sbin and bin and hit Enter.
That's going to export the--
or is going to set the path environment variable.
As you can see, when I type in ENV, the path is now set.
I can also set the term variable.
So I can say term is equal to X term.
There we are.
And I can then say export the shell
or set the shell environment variable to bash.
There we go.
And again, this and just ensures that the interactive shell
that you've obtained is fully functional.
Although, as I said, it doesn't have job control.
But that's something that we'll be exploring.
So again, we can now pretty much perform
whatever we wanted to do.
We can check whether specific utilities are installed.
So we can essentially do whatever we want.
We can execute commands, so on and so forth.
One-- again, as I said, obtaining an interactive shell
is very important.
And you'll actually see this.
If you actually follow along and try and use
a noninteractive shell, you'll find
that it's very confusing because you don't know
what command you just typed.
You don't know what's the output.
Some tools don't work well.
You can't authenticate to services
because it doesn't display dynamic data
or it doesn't actually have the ability
to emulate other sessions within a session.
So, yeah, you can utilize all the techniques
that I've highlighted in this video
or in this practical section.
With that being said, that is going
to conclude the practical demonstration
side of this video.
All right, so now that we have explored the process of how
to perform local enumeration both manually
and automatically, as well as how to transfer files
onto target systems in addition to upgrading
noninteractive shells, we can now
move on to the Windows privilege escalation
section of this course.
So I'll be seeing you in the next video.