HEY EVERYBODY WELCOME TO next video.
We're going to be talking about exploiting my sequel running as root with purpose escalation now running
my sequel as any user other than a strict restricted user is a bad idea as long as the attacker or the
red team is able to gain a user name and password to my single database which can be done from initial
access you can find a config file you could have compromised a web application that interfaces with
the DB and as long as you can run sequel queries you can get this whole thing done.
So if you controlled the web app that has a connection to my my sequel database you can make this work
and in most cases my Secret Service is going to be running as the user my sequel.
However in some cases people install it and run it does route.
Whether that's easing you know for convenience sake or whatever the case might be if you see in my sequel
service running as root there's going to be a problem.
So what I want to show you guys here is U.P.S. álex Now keep in mind this is my machine or my compromised
machine
so you can tell that this is the one twenty two machine and if you come over here this is one twenty
four so one twenty two is our is our victim machine.
So right now we've assumed we got initial access whether that's from a web app or whatnot.
We have a base user access with no privileges so standard privileges.
Now what we're gonna want to do is we're gonna take a look at the web app.
I'm sorry.
Let's take that step back.
Yes.
álex grep Apache not Apache being my single person so we can see here that my sequel is running his
route.
That's a giant red flag for us right away.
So if we go ahead do or die.
You know we can see that there's a config file so if we go ahead and count up the config file we could
see right here we've got a user name and password for our database.
Now this is good.
So we've got my Secret Service running his route.
You've got to use name and password for the database.
Now with those things in mind we can now use a UTF privilege escalation exploit that works on my sequel.
Now UTF is a user defined function.
So essentially what happens is as we compile some see code that defines this function that actually
execute command of some kind whatever we give it.
And the C code is then compiled into a shared object.
So think of it as a library file then that library file is then moved into the My School database as
raw binary.
And because my sequel service is running his route we can then use sequel commands to dump the file
the shared object file into the correct library folder for my sequel to use that as an actual library.
Then from there we can create a function inside of my sequel that points to that shared object and basically
invoke the function that we've built ourselves.
And with that we can then execute system commands and do whatever we want so to show you an example
of this.
The first thing we're going to want.
Actually before we get there.
If you want to follow this particular vulnerability then just below the video the first sets of commands
are actually how to configure this on your Cally machine.
You run into problems go to the Facebook group and more than happy to help you out but if you follow
those commands you should be able to get this vulnerable on a Cally machine that you already have and
then you can test it out from there.
Now we've got our username and password and we've got our my Secret Service running as root.
So the next thing we need to do is actually pull down the C code that we want to do.
So for that we're going to use our attacking machine.
Now keep in mind that architecture specific issues do come into play.
So if you compiled on a Kali machine and you're trying to move to Ubuntu machine or a central US machine
you're going to run into some issues.
However you could compile this on the victim machine and that would work perfectly fine.
But I'm going to compile it on the Kelly machine because our victim is a killing machine.
But just keep that in mind that when you're doing this on another system you're going to want to compile
it locally to that victim just to save a little bit of time especially if JCC has already installed
on the victim machine.
But keep in mind there are some monitoring software out there that look for a web web users or restricted
restricted users using GCSE and compiling stuff when it's not necessary.
So just keep that mind you might throw some red flags so the first thing where do you UW get HDTV 0
x dead beef info flash exploits slash raptor UTF to not see
perfect.
So if we go ahead and look at that code we can take a look at it.
All we want but essentially it has the whole exploit as well as the C code that we're gonna be using
so you can see here we're greening use a defined function we're creating due system which takes an arguments
and then it actually executes a system call.
So now you can know what do system does.
And that's the function call we're going to actually use.
So now that we've got the C code the next thing we really want to do is compile it.
Now this takes this as two steps overdue GCSE dash G C and then raptured out C we're gonna go ahead
and compile it into an object file.
Now the next part is the making it into a shared object.
So what we can do here is GCSE dash G dash shared dash capital W one comma dash so name dash raptor
UTF 2 SL dash 0.
Raptor.
Oh God.
So.
And then the C file and then dash LC Oh not w one.
I'm sorry it is W L
so you here we've got our raptor EDF to that s o file which everything's all good there but what we
need to do is going to slash temp and then we're gonna do a W get GDP 1 9 2 to 1 6 8.
I want a 24 slash Raptor.
You deserve to die.
So we're gonna want to head and grab that and we'll do to some port
and then on our attacking machine we need to go ahead and set this up.
On 80 and we'll go ahead and grab the file.
Now keep in mind we are grabbing it to our temp location on the victim machine.
We've already compiled it over there.
Then you don't have to worry about this stuff.
So what we'll do now is we'll set up our net cat listener for because we're gonna need that later.
Now we're all of this past this point is gonna be on our victim machine so the next thing we're gonna
want to do is actually gain access to my school so we can do that with my sequel deck you route and
then dash P and it's gonna ask us for the password.
Now this is gonna be the password that you found in the config file.
Perfect.
Now with this we're gonna want to use my sequel.
We're gonna actually we want to look at the my sequel database specifically and the next thing we're
want want to do is we need a temporary table to hold are shared object raw binary sense.
Again we need to pull that binary from the temp file which is built by our user admin in this case or
any other guess user could be WW Dash.
W w w dash data doesn't matter so long as it can read to some location we can dump the file there and
we'll when you want to do is really load this into my sequel as right as raw binary number and dump
it to a location that we actually need it to be in in order to create the user defined function which
only happens which happens to only be in a root based and own folder.
So you have to be root to right to it but luckily my sequel provides us enough commands to be able to
do such things.
So what we're gonna want to do now is do insert arms sorry we need to create the table first create
table we'll call it foo with line blob.
So that's what we're going to be using for our raw text.
So we go out and create our table now before we can continue we need to actually grab the plugin directory
because the plugin directory is going to be not in the exact same place that you're expecting it to
so to get this we're going to do show variables like
now and I want you to do is see this plugin directory.
Note this down.
We're going to need this later.
So I'm just going to copy it for now but just note that down because that's where we're actually going
to want to dump the file to.
So now we've got that done.
We need to insert the raw data from our shared object file that we've created and moved over into our
table so it can be stored temporarily in my sequel.
So insert into foo values and we're going to go ahead and provide it the Load File function and then
inside that we're gonna give it the path where we dumped our file.
So in this case temp raptor UTF 2 data.
So.
So when we go ahead and do that we've now got our raw binary loaded into a blob which is just raw binary
it keeps the actual text as is including the Unicode and inserted into the table so we can now export
it as we want but this is where this plugin comes into play.
So what we need to do is do select all from foo which is our only one is are our shared object file
into and then we're going to dump a file.
Now we need to give it this path and then raptor UTF 2 data.
So so with that we have successfully dumped it.
We've we've imported it raw into my sequel database into a table into a row.
Then we've gone ahead and dumped it to this directory which is only owned by Ruby.
So we've.
So what you can actually do even a step further.
Just just with this much so far forgetting the fact that we need to use you to define functions just
getting to the point to where you are loading something into my sequel and then dumping it you can overwrite
the pseudo risk file if you really wanted to.
So in this in this example you're pretty much done if you really wanted to go that route.
But I'm going to show you the full exploit so you can get a better understanding of how it works.
So with this done the next thing we needed to do is create the function.
So if we do create function do underscore system like we showed it in the raw text as well returns an
integer and we're also going to use so name because we compiled it with that and then what's the the
shared object file Chapter underscore UTF 2.0.
So perfect.
So we didn't get any errors.
That's good.
But we need to do it quick double check to make sure it's actually been defined as a function.
So we do select all from my sequel Book and perfect we see due system we see our are our shared object
file and we see type function.
This is exactly what we want now to execute any code with this due system.
We do select and then our function call
and that's it.
So now whatever we want to actually have executed goes in here.
So we'll do that Cat 1 and 2 to 1 6 8 1 4 port four four four dash e been Bash and we'll throw that
into the background.
So when I execute this we should theoretically get our show here with route
and we do.
So if we're going to I.T. There we go.
We are now route and you can take this a step further however you want.
This was just getting back a shell you could a W got W get a binary and then actually have an execute
so you can run this multiple times so see we've ran this once.
I'll go ahead and kill the process start this back up again and if we run it one more time we can do
this over and over and over again.
It doesn't matter how many times we want.
We have full root access with this due system.
So I want you guys to take a second build this up on your own environment and then exploit this from
from the beginning to the end of the process.
So there's a detailed step by step guide below as well.
And feel free to pause to watch the video as you need and then see if you can take this a step further
and gain persistence with just your due system command before you actually get a further show.