[Music] what's going on guys in this video I'm
going to talk about local security restrictions in Windows and Linux hosts
so you may find yourself in an environment where you're in a really
restricted kind of Windows machine or Linux machine where the IT administrator
has locked down a load of binaries and executable so you can't do what you want
to do so for example you can't get yourself for a reverse shell you can't
download file you can't upload files you know you want to break out of this
restrictive machine but you're struggling so there's two projects that
I've come across gtfo bins for linux and low pass for
Windows so what these do we'll start with linux is you can filter
here on what you're trying to do in that restricted machine and it will show you
all of the binaries that might allow you to do that so for example if you filter
on reverse shell this shows you all of the Linux binaries that will allow you
to get a reverse shell on that machine so for example if bash is restricted you
could use gdb for a verse shell or one of the various other binaries which
might not be restricted on that machine you know IT administrators make mistakes
they don't think about certain things there is gonna be some binary that you
can use to do what you want to do and that's kind of the basics of privilege
escalation is kind of finding this kind of stuff so I'm gonna show you a few
examples of doing various things on Linux and Windows based on these
websites and the first one we're going to work with is actually general
debugger gdb so I'm gonna want to download a file so to do that you click
on the gdb which is here and that will take you to this page and it will show
you all the things you can do with GDP so I'm gonna use this to file download
so we can just copy these lines export URL so you copy that in put that just to
recap and what I'm using here so I've got a kali linux box
is my attacker machine I've got a Windows VM which is my Windows victim
machine and I have a Linux box which is my Linux victim machine so anyway we
just copied that so we want to already got this in here so I'm just gonna enter
on that so this is going to be the variable that we're going to use the
general debugger and what this is is my attacking machine my Kali box it's a web
server and calc DHC is gonna be the fake exploit that we're gonna try and put on
to this windows throwing this Linux box so if we just enter that go back to the
bins website copy that already got it again so what this is
that's gonna be the URL you're gonna download the exploit from this is gonna
be the local file so it's gonna be called export dot exe and that's gonna
go to desktop if we then use the next line this is what actually downloads
that file so as I say you might want to typically use W get for downloading but
say an IT administrator is locked W get down so you can't use it this might be
another alternative so click enter on that there you go
we've now got an exploit dip don't you XE so that's one method of downloading a
file the next thing I want to show is how easy it is to read a file so for for
Linux you might typically use cat or even use a text editor like nano or by
something like that say they're restricted you can actually just use
date so if you set the environment variable so we're gonna copy hit should
clear this off set the environment variable as the L file we calls the file
that you want to read so I'm gonna try and read this
do not read me file here so just put that in there that's the environment
variable set copy the next line that doesn't help pop that in here and what
this is saying is use the date binary with this file and there you go that's
what the file says inside there you'll see really sensitive data not for Ray
not for read not very good grammar so that's a really
good way of simply reading a file without actually using a text editor or
cat or something like that so there's various different things you can use for
reading files and this websites really good for showing me that the next thing
I want to show you is a reverse shell everyone loves a shell you know this is
kind of the basics of pen testing as getting a reverse shell and getting
access to a machine so say you've compromised the machine you want to get
a reverse shell so you have persistent access or something but something like
that but you can do that with open SSL you
might not typically think about that you might try and make you know like a
Python reverse shell or a bash reverse shell or something like that but try
open SSL so on your attacker machine you want to start with this first line pop
that into I'm just going to use that one pop that into there what this is gonna
do is actually gonna create a certificate to use with open SSL because
what this is gonna do it's going to create an encrypted tunnel that you can
use to you know do your reverse shelling take your next line here so what this is
gonna do is gonna say listen on port 1 2 3 4 5 with open SSL so that's now
listening as you can see it's not doing anything just waiting they're listening
now we want to use this on your victim machine so our host equals so this is
another that's the wrong thing this is another environment variable I'll clear
that off pop that in there you want to put your our host of course to the
attacking machine its IP address because that's where it's going to reverse shell
back to and then use the next line which is our port which of course is the
remote port we said we're going to use 1 2 3 4 5 which is here on the attacking
machine so obviously you want to connect to the right port pop that in there and
then finally use the last line which is going to create the tunnel or the pipe
using open SSL back to your machine so that's now open the pipe on the victim
machine go back to Kali you've now got a shelter for
there you go you've got that do not read me file there and in the king could meet
your tab you've got a do not read me there so we now have a full show here
next is Windows ok so just to recap they're using Linux let's say we had a
restricted shell we were able to download a file which could be you know
an exploit we were able to read a file so in certain circumstances there might
be permission set up where date might have you know root access by default so
that could read etc shadow and get passwords for example and we were able
to create a reverse shelf so that could create persistent access in Linux all
very good stuff you know GTFO bins is a really good project and i highly
recommend using it if you have restrictive environments so now I'm
moving on to lower bass we can do similar things we can execute a file
where you wouldn't expect to execute files
so using these binaries for example you can whitelist sorry bypass access
control white lists so you know if an administrator said you're not allowed to
use CMD you can actually use these to bypass the access control whitelist you
can download files look at credentials as I say you can do a lot of things here
I'm going to show you two things I'm going to show you downloading a
potential exploit for example and I'm also going to show you how to execute
things using FTP so starting with downloading you can use search util
which is an a standard binary on Windows machines I already have that copy and
paste it in here which is this so what this is doing its using insert util and
this is the IP address of my attacking server on 8,000 like I used with Linux
this is my pretend exploit and this is the name that I want it to be on this
Windows machine here so if I enter on that that will create export Exe on the
desktop which is here which is lovely now say you can't run
that because you know there's some sort of access control going on where you
can't just click run it this use FTP to run a file you
know really unorthodox but it works so if you look down here at execute if we
copy this line here which I've already done in this show here so as you can see
we're echoing the export Exe path into FTP commercial text so we're creating a
file there and that's going to put it into the FTP command and do its thing
and run it basically so if I enter on that you'll see calculators come up it's
used exploit which is the calculator binary and that's run so this is very
good for you know as I say breaking out of restricted environments I really
recommend you go and take a look at that play around with it use maybe your own
lab because it will definitely be helpful on those more tricky
environments where IT administrators really know their stuff and you know
users can't just do what they want but yeah thanks for watching guys give us a
like give us a subscribe thank you