So in this, you know, we are going to take advantage of this sweet binary system, so this system
is a system deep and it is the one service that starts service with a router user.
Generally, it will start with the user, and that's what the user does not have permission to execute
them.
So in this tutorial, I have said this security little as on, that we can execute this system still
as the root user.
So how to find the sweet binaries?
That is the special binaries with the user ID on.
So what we want to do is we need to find common find from a router tree and the permissions we need
to switch for these user.
With that is said to the easy to use, uh, user stands for the user, which should be set.
And what I want is I want the only, uh, file type I don't want for us.
And I want to read this to the owner, which is no black hole.
No, I will get are the binaries that have this set you already picked on so I can execute all these
binaries as a route user.
But now we are focusing on this system.
As you can see it, we have this user system CTO.
So this is a normal desert is a normal user, and we cannot run any thorough comments, so by using
the system, we will escalate our privileges from normal to user.
So before that, I want to show you one thing that is done.
Look at that service.
So you need to define some, uh, variables and these systems, you will identify and execute, uh,
the comments that are specified in this DOD service files, you will get so many of these service files.
And I want to show you a simple one.
So let me take that service first.
So let me take this example, start service.
Let me copy this and let's get.
So, OK, this is not the service where we are going to look at.
There will be.
OK, now let me show you this, how you do service will be, uh, just that overview of this service.
So here you have this unit section and service section.
It is just for are the metadata of this service, your description, documentation, etc. And if you
notice, clearly there is a service and the type is equal to something and you can see there is executed.
So whenever I wrote this, you be able module, then it will execute this command.
So if you press the reversal here and define your own service, then this reversal will execute as a
router and you will get the, uh, privileges at the root on your current system.
So now we are going to define our own service.
It's very easy.
We copy some of these, uh, variables here and in our home for the address.
So sometimes we cannot write any files in the home folder for that.
We want to come forward so anyone can write in the system folder.
So let's Nannerl, let's say shall.
A service, remember, there should be other service extension, so, no, let me call this, uh, foster
parents unit and description to just identify and I'm going to change this.
Just reverse.
Now we can ignore this and copy this service.
And one important thing you need to enter is user, you need to say user is a coaster under which user
it should be generally if you do not enter this route.
But for just, uh, simplicity, purpose we need to share user is cultural.
So now let me copy this.
A good start.
So it's Xiqing.
Onstott is equal to know what I can do is I can place a reversal here.
So let me go to this point to get you to.
So, no, let me copy some bash so we have this bash and let me know how already, OK, I have already
this cheat sheet, OK?
Anywhere it's covid this and where to get our stories, I would open new terminal.
So this is our attacker machine since these two users are on their computer.
I'm going to use one zero zero one as an example.
So to catch up at the current user.
So the 737 not the one that support number one, two, three, four.
Now we need to copy this and we should not try to paint this whole comment.
What we want to do is we need to have been a bash minus seat.
Adequate discussion as this bashes are so big bash this reversal.
Salpeter No, keep the conditions now that you have created your own shuttle service.
And let me save this one.
So now if I say cat.
Shelter service, we have this, uh, service user on the route and execute on startup, uh, it will
execute this one.
So before the execution, we will set up.
There is another.
And about one, two, three, four.
So now what do you want to do, you want to set us our belief system.
So that is the actual path from the people that I needed to enable this, uh, shelter service, our
camp.
All right, well, let's show you this memorial to the home for the.
So we are in the home.
So let me say a home shared service.
Keys to your right, all right, now we have set our service, so you just need to start this service
and upon starting this comment, will get a do gooder and we get the reversal.
That is the highly paid Brookshire.
That means.
Yes, Isabell.
And I want to start, uh, shall.
Now, if you see we got the crucial to.
Who am I?
We will see it.
So we have successfully got the control of this computer.
So in general scenarios, you need to switch to the Linux IP address at this point.
So just I want to show you the one.
That's why I put the same address.
I hope you have understood this system here.
You just create the one service and execute a need to set the reversal on state of command.
And you start the service.