HEY EVERYBODY WELCOME TO next video.
We're going to be talking about common Miss configurations on the Linux and Windows platform.
Now it's important to understand about quote common mis configurations is that it can be very variable
between different systems and how they were originally purposed such as machines that were purposed
for handling traffic are going to have different configurations than machines that are meant to handle
let's say just configuration management.
So this I can't go over everything.
There's gonna be times where you're gonna have to do a little bit of research on it.
Now what I can suggest is when you find in your honor system and you find yourself looking for privilege
escalation your exploit local privilege escalation exploits don't work you're kind of stuck with looking
a little further and trying a little harder now.
Well you can do is look up that particular OS and privilege escalation tutorials.
That's a good place to start.
I'll give you a generally different ideals whether it's Windows or Linux.
You should have a better idea and kind of a little bit more step somewhere to go.
There's a lot of tutorials out there.
Everybody does things a little bit differently and it's good to soak up as much information as you can.
One little tip and trick that you can add to your own notes is more than enough worth the time and effort.
Now what's important here as well is that when you're looking at services such as services running as
root services running a system or administrator you're going to want to take particular interest to
those services.
Now when you take a look at those services you want to look for mis configurations in them.
So that's just as simple as starting off when you're a beginner and you're starting to look at services
that need to be missed that are mis configured or could possibly this could be mis configured your best
idea or bests.
STARTING POINT is going to be to go ahead and Google that particular binary or that particular service
with security mis configurations or privilege escalation or just to kind of get yourself a starting
point of what you need to do.
And that's key because there's a lot for security.
In general there's a lot of building off of stuff that you already know and unless you're familiar with
how this application works how it's been configured how administrators commonly configure it then you're
going to have to start with learning more about it.
And that's why red teaming and the offensive side of security is very difficult it's because you need
to understand not just how to configure something and how someone would commonly configure it but how
to abuse that.
And that's why a large depth of knowledge is is required to start getting into this like this type of
work.
But a lot of that can be short sided with using your own brain and Google now between those two you
should be able to figure out any answer you need to whether that's running through the configuration
yourself and seeing what common things you run into specifically with Web services and databases install
them yourself identify common things that you do on a default install versus a slightly modified install
and get more familiar with the service that way when you go and actually attack my SQL Server as an
example you'll know kind of what to look for at least as a starting point and then you can start looking
at configuration files and stuff like that to get a little further into what you're trying to look for.
Now what I want to start off for Linux is right now we have a user called admin who does not have any
administrative privileges currently.
Now we can do this with.
We can see that we have the password passwords password.
This user can run Sudo.
There's nothing really around it.
So what we can do first is there is a part of Linux that uses something called sticky bits.
Now what this is is this allows you to execute a binary as root instead of your own user.
And that's common for things like pass WD sudo that we just use things that require an additional level
of privileges that your current user might not have.
But these most of these binaries are built pretty well to avoid abusing it like this.
But what we can do on systems is we can just grab a quick list of every single pseudo bit binary in
group pseudo bit binary from the system and see what we have as options so we can do that with fine.
So if we do find the root path we'll do type as file so you can do this with directories as well but
we're looking at files specifically and we're going to want to do some or here perm dash 4000 which
I believe is the pseudo bit or the sticky bit or perm two thousand which should be the groups or I might
have that backwards I'd have to double check.
And then for each one we're going to exact an L.A. stache El we're going to close it off and then we
don't want to see any permissions denied.
So we'll go ahead and kick these to get.
No.
So we go ahead and run this you see we have quite a few quite a few options so far we'll give it a second
to finish and there we go.
So we can see these are all pseudo bit binary and you could tell this based on the S here for the user
or s here for the group the S will be are in place with the X. If it's pseudo.
So if we look here we can see common things such as skip that we could see things as new group.
We have pseudo we have Mount we have past IBD and all these are great but we want to look for something
that we might know such as what with and map is on here as an example we can do interactive mode if
man is on here we can go with that less is on here we can use that too.
So think about this is similar to using a shell scape.
So you're trying to break out of a jail shell if you're able to execute a shell in different permissions
and you should be good.
So if we take a look here we can see that we have them as or the eye as well as a little bit which means
we can execute VII.
Now what's interesting about this is is it's not even if we spawn a shell it's going to spawn it in
as our current user.
So we don't want to do that.
What we can do is we can abuse the fact that it's a text editor and just edit a pseudo file.
So if we go ahead and abuse that we go user been them does set duty at GTA K and we do DC pseudo ours
file see if we can see if we can edit this and add our current user as a pseudo do admin call
o equals 0 0
and look at that.
We're able to save it.
So that means all we have to do is pseudo as root and launch a prompt.
So this is gonna ask us for the password for the admin account which we already know.
Which is our current user but not the roots password.
Put in password and boom.
We are now logged in as root perfect.
So with this we're able to abuse the sticky bit of them to edit the stories found out ourselves to it
which then allows us to pseudo up as root and we could pseudo and run anything we want.
We could have added a user and then made them part of the root group.
It's all in type anything.
Anything is possible once you have access to the pseudo style.
Now that's just a quick example on the Linux side.
However on the Windows side I want to bring your attention to something else.
Now it's common on systems like this to run something called always elevated it's always install elevated.
Now what happens here is that when administrators install set up this registry key it allows them allows
users to install MSCI binaries.
But when it installs that the current user is going to execute that MSA binary as system.
It's going to run as system and that is a can.
That is a mis configuration.
This option isn't available in later versions.
However on earlier versions it is so weak.
What we can do is we can actually abuse that so if we go ahead and go in to our console we can use we
can generate an A.I. script.
So in this case we're using interpreter reverse DCP El host and I'll port and dash f for A.I. and we're
going to export that and we'll build up the binary perfect.
And we'll do one.
Take a look at it and there it is.
So then we'll do a python dash and simple HBP server or 80.
So let's go ahead and grab that.
Here we go.
And we'll go and save it.
There we go.
So we can see this right here and we should already have our AM interpreter shell running perfect.
So this is just the handler just to catch that same shell.
We'll go ahead and execute this boom.
So there's been a problem with the installer.
We go back here.
We now see that we have our show.
So if we do a quick look we can see we are the guest account.
Now I'm not going to do get privileges or anything like that.
So what I want to do is just drop straight into a show.
But as you can see where Windows system 32 which means the process is running under the context of the
user guest account but the actual privileges are system level.
So if we did a net user let's say test at we've gone ahead and created a user which is not possible
for a standard user.
So we'll just go take it a step further that local group administrators test had and we've added our
new account to the administrators group.
So performing this is a very very easy way to escalate privileges and this is just one common way.
What I want you guys to do is take a moment and look up privilege escalation tutorials on both Windows
and Linux.
It just don't.
Don't think about it as a specific OS just look up how they're doing and what they're looking at for
common things take you know an hour or two and just really dig into a lot of these tutorials and make
a bunch of notes.
There's always little bits here and there that allow you to work with services or file permissions or
there's common services that tend to be exploitable such as my sequel if it's running his route on a
Linux machine.
So just take the time go through it look at a bunch of Toros.
I'll link to a few above the video so you can start there.
But there's just so much in this space for common configurations on every different OS that it would
be impossible to make a series just on that as everything always changes between versions.
So go ahead take your time.
Go through those tutorials at least the ones I have above.
And then start making a list of notes of common places to look for Windows and Linux.