Everybody welcome to the next video.
We're gonna be talking about breaking out of a jail cell.
Now sometimes when you gain access to a machine or you gain access to an Apache user or some other user
sometimes the shell is either restricted on purpose or it's a jail shell.
Now that there is a there is a there is a big difference between the two.
Now there are system based.
And then there's application based now a system based jail shell is going to be when groups are the
idea assigned group to that user either has IP table rules that don't allow TCB traffic or ICMP or UDP
traffic at all.
Maybe the type of group has certain access restrictions where they're restricted from going to countless
places maybe based on their Bashar c file.
They do not have any specific parts preset like a standard user would.
And then there's the applications type shells.
Now there's quite a few of Mali those do you guys to take a look at.
But in a nutshell the you'll find yourself in one of those two situations normally like Kay shell or
El shell or something along those lines you'll know right away what type of shell you're in.
Based on that.
And normally this is this is done with restricting binaries that you can run or just reducing commands
that you're able to use.
Now there's a few ways you can kind of break out of this I'm not going to this is not gonna be an all
inclusive list but this should give you a good idea of what you can look for.
There's a thousand guides on how to break out of specific types of jail shells and then there's some
generic ones that kind of work across all of them and depending on if it's a system based one those
tend to be a much more difficult to get around you kind of had to look for mis configuration for some
of those.
But here are some some quick examples.
So for example when we look up which we do I.T. right we have a full path for it but that's because
our entire environment environmental variables so if we look up our path up top here
OK we'll just go out
so we can see here this is our path and this is pretty standard which allows us to access things and
local s been local been user s been user been slash band.
So this this might not be there.
So can you use the full binary.
So let's say if you couldn't use I.D. could you use the full full path of I.D. which is user been.
So could you use user been I.D. so make sure.
Because it might just be restricting it and just have the parts not present which is just a way for
us to just go directly to the binary and see if you can execute it if you can then it's just a matter
of trying to find out where the binary is on the system and getting and getting execution from there
which you can take a step further if you find that Python's installed some more than you can get a python
interactive show.
So find out what binaries are available.
Speaking of python there is a way for us to do this.
So if we do Python dusty and then we do import import or OS and then OS dot system and we give it then
S H.
So the long run that it should go ahead and launch launches our prompt and again with we are the correct
I.D. which is fine.
So that's just a quick way to do it with Python.
So long as Python's available you can relaunch yourself out of that and get yourself out of it.
Another one is VII.
So if we do the I whatever we want to do here and go and s h but it's going to drop a straight into
a shell just like normal.
And if we exit out we'll be in the eye again.
Go ahead and close that.
So that works with the eye.
Now there's one quick way if we're allowed to use slashes in and it's not restriction so there's no
character restriction on the show we can just do an S H just launch it directly and see if that allows
it to work.
Sometimes it works sometimes it doesn't.
So what are the next ones that you can do now.
There is one you can do if you have control of path you can just go path.
You need to do is you can copy basic paths that you're going to find on a common system for this type
of system based on you name Dash.
As an example you can grab what type of system it is and grab with the local basic parts are and then
go ahead and do export path equals and then set X
export path equals two and then you set it to whatever you want and if you can do that if you can control
path then you can allow yourself more access to binaries as long as there's no group and restrictions
like that so another way we can do about this is if you have access so if you do go out our path.
Right.
We can see maybe we've got a few executable such as we'll take ideas and example.
So if we can access I.D. what we can do is we can overwrite I.D. with another executable or we can make
a semi link to something in our path.
So if a slash burn is in our path we can add a binary to s been or not necessarily binary but assembling
to s been that goes to bin bash and that will also bypass it as well.
Now with FTB we can do this as well FTB is not installed on this machine unfortunately.
However once you're in the NDP prompt that will go ahead and launch your show.
So GDP GDP is kind of the same way we can do.
You know I've been H
about that.
It is not that it is this area.
Now we can see we're in.
We are inside of GDP and we've gone ahead and launch the command.
So go ahead.
Get out of here so that works with GDP now more or less and man.
Kind of all worked the same way as GHB does.
So if we do man LSD as an example and when we do as h we'll go ahead and launch an ice age problem.
So I'm not going to show you the example of less or more.
It works exactly the same way as long as you're the page you're looking at or the file you're looking
at is bigger than the screen you're looking at.
Make sure it's got more to scroll down as long as you can do that to a commission point as H.
Go ahead.
More just the same.
Now if you have access to OK you can go ahead with that as well.
So we can do begin
again and we'll do a system
that's wrong to us system
and say h
and we got our prompt as well.
And there's another way we could do this would find actually if we have the access to fine we'll look
at the route.
We'll do a name and we'll look in test doesn't actually matter.
As soon as we find test will go ahead and Zack in H and go and run it and boom there you go.
Got already just exactly the same as we were.
So this is just a few ways you can break out of a jail show.
No arguments.
Again it's not an all inclusive list.
There are quite a few things you might have to go about and maybe there are certain restrictions.
It depends if it's a custom jail show or not.
But in most cases you can use some of this to break out and get your initial access.
There's also other ways such as using as a sage where you can access to the machine and spawn off different
commands right away before the console has any time to prep the jail cell.
There's quite a few ways to go about it.
But what I want you guys to do is take a second and look up how to break out of a jail show with a history
file.
Go ahead and test that out and show us a screenshot in the Facebook group what you guys were able to
do with that.