Linux Hackers Become Root with CURL & Sudo

WATCH MORE:

🔥YOUTUBE ALGORITHM ➡ Like, Comment, & Subscribe!

[Tibrius]

Appreciate the shout out John! This was a really interesting privesc. :D

[TheMAZZTer]

Your first python3 web server is running as "user" which is why "user" needs access to /home/fry/.bash_history to successfully serve the file. There's no security exploit here. Hence why you needed to adjust the file permissions. I would expect users wouldn't run that server since it doesn't give them anything they don't already have.

Edit: The second python3 server running as fry is better since you smuggle in a file fry has access to into /root/ using curl as root. But ultimately you could have done the same by using curl as a fancy cp.

[almog]

You could also rewrite the /etc/shadow file, edit the uid of a user u have in /etc/passwd…

[aalbatrossguy]

man, I love your videos :)
keep up the good work :)

[liveting]

Hey John, is there anyway to reach out to you about setting up vulnerable servers?

[DHIRAL]

6:00 Doesn't python server read the file and serve it? How can curl having the sudo perms make python be able to serve a forbidden file?🤔

[ChillstreamCentral]

wait a min. i didn't get that, when we access that file via curl its requesting python server for that file and python don't have perms to read that file, how the hell curl suid perms allowed that?

[ToyeTuning]

Always great videos. Thanks John!

Edit: I often make the same mistake when doing links 😂.

[gabrielex]

That was neat, the only downside is that this way if the authorized_keys file does exist you'll be overwriting it, so the original user wouldn't be able to access anymore using their key.
Also root ssh access could have been disabled for safety reasons.

[algorithmblessedboy]

3:10 lmao I am watching at 23 pm and i got flashbanged

[mihaiciocan]

Hi. Just a quick question. If you had access to write, is there a possibility to overwrite the/etc/shadow file with a new hashed password that you actually know for the root account?

[Whothefuckareyoutojudge]

If you fixed up the perms, then this wouldn't work, because the HTTP server would need to run as fry or root to read any of fry's files.
Could've just "cat /home/fry/.bash_history" at this point instead to save time.

[NANa-nzpz]

John, what do you think of Tcm security training?

[luis-rvjj]

how to access one system to another system

[xCheddarBbx]

Great stuff. I now have more CTF problems than I have time. LMAO 😅

[RuggMatt]

Someone once time me the order of the params for ln is the same as mv and cp and i have never forgotten it since.

mv <old> <new>
cp <old> <new>
ln -s <old> <new>

[definitelyno]

The first curl example does not make any sense. The web server that reads the symlink will do it as the same user as is running curl and the web server. Curl simply does nothing in that case, just that the permissions were set incorrectly.

[sluuny]

Love your videos !! Thx !!
Is this Kali on bare metal or in a VM ?

[petermoras]

Privilege escalation, in MY sudo? It's more likely than you think.

[thespecialchannel]

if he's already running commants using fry and using sudo then where the heck is the privilege escalation