b00t2root19 CTF: Groot (3/3) [LINUX Post-Exploitation]

Key Takeaways

[Music] hello ladies and gentlemen my name is John Hammond welcome back from the beauty video we're talking about the boot to route CTF for the 2019 edition we're in the Linux category and this is the last challenge in that category called grouped we know groots no more but we can still hear him in the environment can you and we have our connect Auto Sage script we have to solve Tony stank first as in we need to become the Tony user because that gives us our privileges and this is the again the exact same connect auto sage script so this challenge has been growing that it has been kind of continuing off itself building off itself so here I am still logged in as Tony and that user I minimize that on accident ok so what we know now is that we have said as a potential prove privilege escalation Avenue right because it is running as a set UID binary been said so we have routes privileges when we use said we can check out gtfo bins and we could get a root shell potentially we also can write files as rude etc etc we could we can use this to do a lot of damage potentially all we've done so far is just read a file with it so knowing that challenge prompts I'll showcase just reading that file again it was dot flag because that does not have any LS it does not have any user privileges only root can read that so very important that we know that in this case now what we can do is something very very special pertaining to this challenge prompt it's a hint here we know groups no more but we can still hear them in the environment so environment right you'd think of environment variables you can check out env you can see we've got a lot of environment variables that are said none of them extremely useful right now but remember we want to know the routes environments and routes not a user so it must be referring to route the Linux user route and remember when we checked out running processes we have route doing this thing that had the original flag and that's process ID one route has a lot of other processes running so if you wanted to why don't we check out the environment variables for every process that's running right maybe we've got some some good Avenue there you can check through one of these one by one you can do a loop however what I'm just gonna end up turning for years you go ahead and cat out like we had done before with proc folder in the links filesystem you can check out all the different thing information you can get about our process what the command line is the executable move in that current working directory etc if you had that privileges we could check out proc one command line and that's what we did to solve the first challenge or we could check out some other information like the environment variables and Vai run is what it's called sorry and we aren't able to read it as Tony remember because it's it's routes environment verbal so you have to read it as route said gives us that capability so we can run said nothing regular expression to replace or work with we just read that file and there we go again if you were to pipe this into strings and in a machine that you had strings on you could see that a little bit more readable fashion however we've got flag equals boot to route I am Groot and that's that that is the last challenge in the Linux category go ahead and submit that for that many points and now you're on the list now you're in that that portion I know that we did get first blood on that only some more than certain we got first blood on that I maybe we didn't I don't know thought we had I'll be obviously we hadn't but I know we were very excited about it and Raj and I when we again profs tirage special thank you to you for participating with me and in this quarter server if you are do the discord server you absolutely should be link in description come hang out if you like this video please do like comment subscribe I'll see in the next video [Music] [Music] [Music] [Music]