See if we're funny.
All right.
Awesome.
So while I'm encoding the last bit of the first exploit development video, I am going to be showing
you the how to drop chain in 64 bit.
So first, I want you to turn off Asla.
We haven't yet got to the Asla bypass yet, and we are going to pull the image.
The image is called the pseudo docker pull.
Let's see, you can write ups GHC I0 slash 27 slash tpz dash barracuda latest.
So I already have this image.
And the next command you want to run is.
This so we can just exit this.
In this module, we're going to use a rock chain to you can actually just pretend this pseudo by way
we're going to use a rock chain to do a privilege escalation.
So I don't want you to be carrying the flag.
The flag is right here, by the way.
We fly right here.
But I don't want you to be cheating by carrying the flag or reading the flag like that.
I want you to login as a under-privileged user.
So we're going to log in using if you use net stat that up rep 2 to 2.
As you can see, we have a port redirection to the stock container.
So to run this challenge, we're going to do pseudo Docker run double dash, dash IETF, we're interactive,
double dash privilege, redirect our main host port to two, two, two, two to the stage server within
the actual image.
And then we start the image.
And then for debugging purposes, we still run the bash terminal.
So to log in, what you want to do is sfh ctf at local host dash p two, two, two, two your password
is player and if you want to run to mux you're bash less.
This is your vulnerable binary right here.
So if you want to run RT Mux just run.
RT Mux.
I haven't actually figured out how to make the default shell for the S-H bash.
I will update the video or update the container so you all get a bash terminal.
So let's just open to bash thermals.
So bash and then control the shift double bash again.
So that way we can work on our exploit, nano exploit.
PY And then we're going to run a debugging session.
So I was in a bit of a run for time.
So the vulnerable binary here in 64 bit.
It doesn't need a sturdy copy.
It actually uses jit se, which is a read primitive and we actually are going to skip the fuzzing section.
I will add the fuzzing section back in eventually, but at this point we want to make sure that we can
actually overwrite the return instruction pointer.
So on x 64 systems, we need to make a in return instruction pointer, right?
So let's create another terminal C controller.
That's why the code you can use these code, but on parrot they have what they call a totem exploit.
PY.
And let's delete all of this.
So I'm going to add the fuzzing section again later once I'm done with DEFCON and Crows versus Jo's
Security B-sides.
But we're going to make another Python three script shebang.
User bin Python three my god, this thing is slow now.
Thanks, because I'm encoding that stupid video.
What on earth?
Yes.
That's because I'm encoding.
Good Lord.
Yeah.
Has been.
Oh, my God.
Hold on.
Let me just edit out this video.