[Autogenerated] in this demonstration,
we're going to get started with Lynn Pease.
The miter tactic that we're going to be looking at relates to
privilege escalation by abusing the set you I.
D.
And set group ID.
But generally on Linux and mac Os when these bits are set for any application,
that specific application will run with the privileges of the owning user.
So what we are aiming for is to discover any type of applications that have
those bits set that could have been set by a root user.
Now of course you could use the find command to search for such files.
However Lynn Pease will be able to do it for us along
with a lot of other additional checks.
So let's go ahead and confirm that my current logging user is not a member of
the pseudo was group and does not have root permissions.
The first thing that I'm going to do to double check this is I'm gonna go
ahead and try to edit the password file as you know,
the specific file will contain a wealth of information so as I
try to access that file we can see that I am denied and I
definitely am not part of the group.
So let's go ahead and run len P.
S.
The first thing that I'm gonna do is take a look at
the options that exist right away.
I can see that I've got a number of different options
that I can use with Lynn Pease.
I can define a specific check,
I can perform network reconnaissance and a lot more.
But what I'm gonna do is go ahead and run Lynn Pease
with all the checks and to do this.
All I'm gonna do is execute Lynn Pease right away.
We see the awesome logo along with the color scheme and the legend.
Let's give this a minute for it to run so that we can
then take a look at the results.
Now that Lynn Pease has completed, let's work through some of the results.
However,
please note that there is a lot of information that Lynn
Pease has brought back to me to work through everything would
take a lot of time on the video.
So what I would really suggest is that you actually spend some time working
through all of the different outputs in your own lab environment to really
get an understanding of what Lynn Pease provides.
So as I start from the beginning,
the first thing that we have is of course the awesome logo and the color scheme.
We then have some basic information about the current
lockdown user along with the system information.
Now the component that we are specifically looking for
is the interesting files component.
So as I work through the rest of the results,
I'm gonna pause at some of the interesting sections.
For example,
this one that relates to the exploit suggested this is a good way
for you to discover any type of potential exploits that could work
on this current operating system.
We don't have information about any processes that might have
credentials stored in memory and any type of Cron jobs that we
could leverage as we come towards the users section we can see the
super users along with the rest of the additional users and groups
that exist on the system.
And now we come to the interesting files.
The first check that Lynn piece executes is looking for any type of
binaries that have the seward permission right away.
We see two that are standing out and those are highlighted in yellow.
That is the find and the copy commands working through the rest of the output.
We can see some of them are pretty standard.
And then as we scroll down we can see any type of binaries
that have the set group by the bits enabled.
But as I scroll back to the top we're going to focus
on the find and the copy binaries.
So I'm gonna go ahead and open up a new tab.
And the first binary that we're gonna test is defined binary.
So in order to test the find binary and see if we have any type
of root permissions that the binary is using.
I'm gonna go ahead and just create a standard file.
Next I'm going to perform a simple find command.
However,
I'm going to add the execution command with a
command that I would like to execute, for example,
just using who am I As I eat, enter,
I can now see that that specific binary is in fact
executing with root permissions.
The next that I'm going to focus on is the copy binary.
So right now I'm gonna go ahead and make a copy of the password
file that currently exists on the system.
So the next thing that I'm gonna do is actually go
ahead and try to edit the file.
Now as I look at the file I can see the contents of the file.
However I can't really edit it in this current user context.
But since I could make a copy of the file I can now go ahead
and edit this file on my Kali Linux machine.
So essentially what you could do is take the file and
create a new user altogether assigning it.
Root permissions.
Now I've already done that in my Kali Linux machine.
And of course to get the file from this current target
machine to your Kali Linux machine you have a range of
different options that you could use.
So let's take a look at the file that I have already modified.
You'll notice at the bottom of the file I have added a new user account
called proof with a password that I have created.
So now let's use the copy command to actually go and replace the existing
password file with the one that I have just modified.
So right away I see I do not have any error which means it worked.
So let's go ahead and verify this.
If I look at the file, I can see that my privileged account does exist.
So now as I go ahead and change my user, I now have root permissions.
So this is a quick and easy way that I could discover a
binary on the Stargate machine that has a misconfigurations
in the form of too much permissions,
allowing me to leverage that to go and create a new user on the target machine,
which allowed me to escalate as that new root user.