Hey everybody.
Welcome to next video.
We're gonna be working on Pivot escalation would pseudo now on some systems people have configured users
with pseudo rights.
So if we take a look at this use real quick pseudo dash l Dash I clears throat So what pseudo dash L
says the user blah may run the following command.
So it can see we can run them fine man and map without a password as Sudo.
Now you might find other things such as something that might look like this.
So your username all equals all no pass them all.
If you find something like that you have full pseudo access already so all you need to do is do pseudo
Dash.
You brute bean bash and you'd be done that would go ahead and get you root access right away.
But what I want you to understand is sometimes the KISS method or keep it simple stupid is the is the
quickest thing.
No reason to bang your head on a keyboard trying to find some other exploit or some service to make
vulnerable if your account already has sudo access and this works for Windows and Linux so obviously
Windows doesn't use sudo but if your account is already part of a group that in some way shape or form
is connected to the administrator group you'll have to double check that yourself.
So for example a group as part of another group which is part of another group which is part of the
administrators group then you in turn have admin access.
So always keep it simple understand the access that you have right when you get there and this will
be from a Linux perspective specifically with you.
So we've got pseudo access we've done pseudo dash L which is the one the first thing is the first thing
is when I hit on a box is if config pseudo dash L and you name Dash.
Those are my go to write when I hit a machine.
I know whether it's doing homed.
I know my pseudo access and I know what the kernel version is of the OS.
Those are my go tos so with this sudo access we've got a few options.
We've got them fine man and map now all of these options actually provide us a way to escalate to root.
So if you find anything in here even custom binaries which will go over I believe in the next video
around relative paths in pseudo binaries even even custom binaries are not immune to issues when twinning
and pseudo and neither are any standard binaries either but certain binaries running as pseudo allow
you to spawn a shell.
Now I want you to put yourself in the mindset of when we are trying to escape the jail cells because
this is the exact same situation.
You're not trying to escape a jail shell you're trying to use that binary when it's process tokens have
been elevated or the process for that process have been elevated to route because of the use of Sudo.
And as long as you can spawn something a runs or some sort of command off of that binary wallets and
it's pseudo permissions then you can escalate whatever you want.
Now with Sudo VII in this case then you can really just open up the sewers file and change whatever
you want.
So at this point you see VII you own the machine but let's assume you didn't want to go the path of
overwriting a file so you can do pseudo
to pseudo user bean then that GTA and we'll do a know test stopped texting right.
So we go and do that and we are now right that simple.
So let's take it back and let's assume that we want to use find.
Now you can actually use find a spot to show what you do is do fine and then give it some some path.
Let's say you pass WD.
It could be any file you want as long as it just hit something you don't want it to run for like 10
or 15 years trying to figure out every single time it hits a file it tries to execute this you just
wanted to hit one file.
Exactly.
So for every file we hit we want to exact bean Bash that's.
My apologies there.
We should be doing sudo bin bash pseudo fine.
So the user has been fined but we are now.
So again we can do our pseudo dash L so we've got man.
All right.
So let's do pseudo user been man and we'll look at the page less so which one do is exclamation point.
S H.
Done IDI root.
So now we've got full brewed access just from man and the same thing works for less as well.
It's less more and man they all work the same way than we have in map.
So any map is is a little bit of a different use case.
So in older versions of map you can do pseudo and map dash dash interactive and that would work.
However not in this particular case it does not work.
So actually this would be
mad dash dash interactive.
However it doesn't work.
That's not how it's going to work in the newer versions of a map.
So we have to do a little bit differently.
We're going to use an NSC script to actually launch the prompt.
So what you're going to do is echo the NSC script.
And so what we're gonna do is do OS dot execute and then inside there we'll do been s h piping that
into a temp shell that NFC right.
So we'll say if that if that exec then executes correctly and it doesn't have any errors we'll do sudo
and that dash dash script is equal to temp shell dot NSC.
So this is going to do is it's going to create an NSC script with the command OS that execute and then
some command.
Then we're running and map and having an actually it's and map scripting engine actually execute the
NSC script and that's it.
We are now route we're going to go.
So what's interesting in here is there's no t y.
It's not actually showing me anything but I am writing I.D..
Who am I P WD.
You know we have as much as we can and we can just spawn a shell if we really wanted to.
So this gives you a few different ways to escalate privileges with route binaries or pseudo binaries.
Always keep track of what binary binaries you have pseudo access for whether it's user name or with
password or not.
And if you aren't familiar with the executable or the binary.
Go ahead and do a google search with privilege escalation pseudo privilege escalation binary or spawn
shall with this binary you never know what you're going to find where there's some slightly older version
of the binary that might be completely inconspicuous for an admin to update that one out of date binary
is what allowed you to spawn a shell because they gave it pseudo access and now you have full root access
to the machine.
So it's something just as simple as that and it really just comes down to the good guys have to win
every single time the bad guys only have to win once.
So there's there's a lot of things that can go on and you'll start getting more familiar with the different
binaries and different ways you can execute commands from it.
So just on the off chance that you happen to see something you might have found on an obscure blog post
about being able to execute a command on some random binary that nobody really cares about or thinks
they should care about and you're starting to see that pop up on machines then now you know that you
got a path to root on all of those machines if they allow it to pseudo so go ahead.
Take a moment look at your own machines.
Any linux machines that you have and find out what pseudo rights you have and maybe play around with
is put in a few binaries as well in there to kind of see what you can work with and this kind of is
the same process as these sticky bits executable or binaries and in the same respect that it executes
with root permissions or in that particular case sticky bits is just whatever permissions the owner
of the file is and if it's owner group it'll escalate.
It'll run in routes privileges so there are two very very close to each other so always check for those
sticky bits and your pseudo rights.