Everybody and welcome to the next video in this forum we're talking about a technique for privilege
escalation called relative path pseudo binary.
Now what this means is when a binary whether it's custom or not is using a relative path to call another
binary such as for example we do less here this terminal this bin bash terminal is another is a binary
calling another binary S..
So when this happens one of it's going to do it in one of two ways it is either going to do it with
a relative path or an absolute path.
So what I just did right now was a relative path.
There's no full path.
So user Ben Ellis is an absolute path.
So when a binary calls an absolute path it's fine but when a binary calls an absolute path you start
running into a problem.
The reason this works so if we look are environmental variables we have our path parameter.
Now what's gonna happen is when I called l s it's going to go into user local s bean and try to find
less.
If it's not there it's going to go into here.
Try to find it here try to find it.
Here is where it actually is.
So to go ahead and find and run the binary here.
Now if there was another El s inside Aspen it would run that see how it works.
It goes through each part of the path one by one looking for the binary instead of just using the full
power which means it would go straight here.
So we can abuse this.
So if we build if we as long as we can control path then if a binary that is running is pseudo such
as the s you I.D. it being set or it's a pseudo option for your user you can escalate to root.
But there is one thing to mention though the first path that's checked for when we did like for example
alas is the local directories.
So P.W. de so slashed HAMP in my case or whatever the p WD variable is.
It checks that first and then it goes through the path one by one in order.
So when we had something here it'll always start with this first and this last until it finds it.
And then if it doesn't find it at all.
So if we do something like that that means it won't do the P.W. D path and then all of our path and
still didn't find it.
So then if it fails I would command not found.
So how can we use this.
So let's take a look at some of our binaries so let's look for a pseudo as you idea binary.
So if we do find slash desk perm dash 4000 and we'll grab every push everything to death.
No we don't see all the errors and we'll go ahead and run this.
So this is all of our pseudo binaries but what we can see here is we see all pretty normal stuff for
the most part except for this guy right here.
So user been backup seems to be something different.
So what we can do is to check to see if anything's b if anything is using a relative path.
We can do something called strings.
Now what strings does is it goes ahead and grabs the binary and looks for any ASCII text.
And then just dumps it to the screen.
So when we go ahead and go through this you can see that there's just a lot of stuff we can see are
data segments as an example.
But let's start from the actually we'll pipe this into more or less actually so if we look here we've
got the type of binary there's some shared object files it's get you idea get system get system that's
fun.
Here we go.
So we can see it's calling FTB and trying to do a backup from temp backup Tarr now.
But what we're seeing here is that using FTB and not slash user slash been DP or user s been wherever
they have to be variable or binary it's just using a relative path.
So because of that when we try to run user been backup in this case FTB is not found because it's not
sort in the system however even if it was it would be found in one of the paths.
So what we can do is we can actually abuse this by putting our own binary called FTB in a path that
we control.
So if we take a look in our temp directory we have something called FTE Pitot C.
Now this is a quick bit of code in C to spawn a shell so you can write this down.
I provided a text version of that below the video.
It's pretty simple except what you want to do is set your I.D. and set G.
This sets the group idea and the user idea to zero which is always root.
And then we execute a system which has been s h so what we're going to do is compile this.
Right.
So TPD.
Oh he.
Perfect.
So now we've got our FCP binary in slash temp.
However if we do bean or user bean backup we still get nothing found.
And that's fine.
However what we need to do is setup an ad slash temp or FCP binary is the one we want to have it think
is the real one.
We want to add that path that actual directory to our path.
So we do that with export path is equal to our new directory so slash temp.
And then the rest of our variable so this will just tack on whatever the the actual path is so just
pretends it to the end.
Perfect.
Now if you look at EMV we can see temp is in front.
Then we have the rest of our path.
So when it goes through here it should look in slash temp for our binary which will be our own binary
which log which runs us this route.
But if we look at I.D. we can see that we are just admin and now we run user been back up we can see
we get a show and we are root.
So what we've done is we've abused the fact that a binary that has the pseudo bit set and is using a
relative path and we tricked it to having having it think that the path the first path that we provided
it with our own binary allows us to work that way.
Now you can use a similar link called FTB to appoint to whatever you want.
So that that works just as well.
And there's a lot of options you can go with this but understanding how this works with paths and relative
binary inside of another that's being called by different binary or even keep this in mind even other
scripts.
This this can work.
Anything that's calling another binary that is using a relative path can have this issue as long as
that executable is being ran as pseudo.
So just keep that in mind and feel free to follow the guy below or set this up on your own.
The binary that we're using this backup binary.
Go ahead and show you guys real quick so you can get an idea of what it looks like.
So this is that binary.
So essentially it's setting the idea in to zero and then it's going ahead and executing this.
So if you want to copy this out and go ahead and compile it and then to set the binary view CHL mod
you plus s and then of the actual not the c file but the actual binary.
So that'll set it up with the sticky bit or the s I assume but and then you can go ahead and test this
out on your own.