Executing Linux Binaries Without Touching Disk - Living Off The Land with DDExec and Dirty Pipe Demo

Name: Executing Linux Binaries Without Touching Disk - Living Off The Land with DDExec and Dirty Pipe Demo
Uploaded: 2022-04-04T19:08:15Z
Channel: IppSec
Description: 00:00 - Intro, the stream is here: https://www.twitch.tv/videos/1445106911 00:45 - Start of the video, showing what is new about this technique 02:17 - ...

IppSec · Beginner ·🛡️ AI Safety & Ethics ·3y ago

00:00 - Intro, the stream is here: https://www.twitch.tv/videos/1445106911 00:45 - Start of the video, showing what is new about this technique 02:17 - Running through the example, showing we can change the filename in ps to anything we want 03:15 - Showing what this looks like in the ps output 04:15 - Explaining what I don't like about the example used on the website 04:55 - Explaining what process substitution is, which is a really good way to pass arguments to bash scripts when piping with curl 06:00 - Testing process substitution with ddexec locally 07:45 - Showing how to execute this with…

Watch on YouTube ↗ (saves to browser)

Chapters (13)

Intro, the stream is here: https://www.twitch.tv/videos/1445106911

0:45 Start of the video, showing what is new about this technique

2:17 Running through the example, showing we can change the filename in ps to anyth

3:15 Showing what this looks like in the ps output

4:15 Explaining what I don't like about the example used on the website

4:55 Explaining what process substitution is, which is a really good way to pass ar

6:00 Testing process substitution with ddexec locally

7:45 Showing how to execute this with DirtyPipe

9:45 Successful execution of DitryPipe

10:30 Showing a dirtypipe that changes the root password, changing the default passw

13:20 Showing we changed the password, and then trolling myself because this box has

14:45 Finding a DirtyPipe exploit that modifies a SetUID

16:30 Cheating at our game of Hacker Wordle, to make sure we actually changed the ro

Playlist

Uploads from IppSec · IppSec · 0 of 60

← Previous Next →