Try Hack Me : Linux PrivEsc

This is our continuation series of Junior pentesting learning path on tryhackme.com. We are exploiting! Lets have some fun! This is the longest of our series so far and covers in depth about linux privelage escalation!
Patreon to help support the channel! Thank you so much!
patreon.com/stuffy24
Hacker Discord
discord.gg/KzzGfnKjCS

[@user-ib9rt2kp1h]

13:40 - privileage escalation kernel 24:10 - sudo ex 30:00 - suid ex 47:19 - cron jobs ex 55:00 - paths ex 1:07:25 - nfs ex

[@G30dude]

Thank you very much! Im 28 years old video editor doing a career change into Cyber Security the past 5 months now and it was really hard some rooms in the JR pen test but with your videos it was much easier to understand.

[@stuffy24]

Awesome man good to see! Do what makes you happy!

[@dangervasio4100]

Stuffy your content is fantastic! I know you keep referring to how long the videos get but I think I can speak to everyone that we don't mind the long videos. The longer the videos the more you explain in detail certain things that new comers like myself have trouble grasping. Thanks for all the help and detailed explanations!

[@stuffy24]

Thank you! I will keep that in mind! Sometimes it's hard to believe ppl wanna watch a 2 hour long video haha

[@KateKrauss]

The answers to these THM questions are in 10 different places across the internet. So the value in your videos IMO is not in your giving the answers but in your contextualizing the information --what are we really trying to do or learn in this room? What do we really need to know? Also, clearly explaining things that are badly written in THM (which is common). And spelling out the small details of the process so that we don't get stuck for some tiny detail even if we basically understand what we are trying to do. While these rooms are of course easy for you, many of us need every breadcrumb we can get to understand what we are doing and learn. I am not coming to these videos for the answers to the problems, although it's helpful that you include them. Instead, it's the clear and contextualized explanations that matter. I personally don't care how long the video is--very long fine as long as it's clearly and completely explained. (It would be great if you time-stamped them by question, though!) Anyway, thanks again for these, they are invaluable.

[@stuffy24]

Thank you!

[@iCyberVenom]

Stuffy at it again with a FANTASTIC walkthrough! I've learned so much from you at this point it's ridiculous. Thanks for everything that you do.

[@stuffy24]

Thank you so much! If there is something specific you want to see make sure to let me know!

[@iCyberVenom]

@@stuffy24 I actually do have one question: For SUID priv esc, can you confirm if 'user2' or 'gerryconway' are able to view contents of flag3.txt? I've cracked the passwords for these users, logged in as them, and I'm still getting 'Permission denied...yadayada'. I was able to use base64 to view the contents, but was wondering if you're just supposed to use cracked passwords/login as other users/view flag3.txt. It would kind of defeat the purpose of a SUID priv esc room if you could just use john to crack the other users' access to view contents of flag3.txt, no?

[@raiders18dr]

Thanks for doing this. Super helpful. Love reading the instructions and then hear your interpretation of whats going on.

[@stuffy24]

Thank you man! That's exactly what I'm trying to do is help people who don't just instantly understand things bc that's me lol

[@esterinkojtari]

Even though this video's been around for a year, I just gotta say thanks a bunch for this and your other vids! Your enthusiasm for this stuff is contagious, and I'm loving it!

[@stuffy24]

I appreciate that a lot man!

[@bitcloud7732]

Finally learned privilege escalation thanks to u man. Really helpful.

[@wilfordschaffner2166]

Thanks for walking through this and posting this vid, it helped me A TON. You're an awesome teacher.

[@stuffy24]

Thanks so much!

[@MohmdSy5]

You left me speechless, I am loving the way you explained it, while letting us try our own techniques. Thank you very very much

[@stuffy24]

Thank you

[@unmuktyatree8200]

You are a champ ... for soem reason I always find your video more helpful then others. Its probably the pace with which you run the lab is not so fast and I find it easier to follow your instructions.

[@stuffy24]

I appreciate that thank you

[@wolfyyybandz]

Thank you for taking the time to explain and teach us what you know! This challenge was tough and this video was most helpful! 💥💥💥💥💥

[@stuffy24]

Appreciate you!

[@ShrutiSharma-xu6qs]

It was really helpful that you were not just solving away, but also explaining! that helped a lot!

[@stuffy24]

I appreciate that. Thank you

[@ShrutiSharma-xu6qs]

@@stuffy24 right now also I am following along your video only😂

[@jaywandery9269]

Thank you man. Today you gave me all the reasons to become one of your patron. I will subscribe now

[@stuffy24]

Thank you so much!

[@aaronbanks3673]

Excellent video. I could usually get the flag myself, I was just missing a step or two in between. Thank you for making the video!

[@Macj707]

Hey thanks for the Videos, I enjoy Learning with you, and I thank you for that!

[@stuffy24]

Hey thanks! That made my day!

[@akereledjubril]

Really appreciate it, clarified a lot of questions

[@bezalels8313]

Great walktrought very clear. thanks

[@MsSpaty]

Hello, It took me 5 hours to follow the course with you. Take notes, understand everything, 1 month ago i had no clue what an ip was. Just finished the capstone alone in under 40 mins, all probs goes to you.

[@stuffy24]

Very nice well done

[@777jac]

Thanks, Great explanation ! Only need to research about the gcc compiler

[@stuffy24]

Thank you!

[@kalyangarlapati1633]

loved your walkthrough ❤❤ we are waiting for offensive pentesting path now

[@stuffy24]

Doing cyber defense path now then we can kill that offensive path!

[@sirprancealott2003]

Awesome practical explanation - many thanks! 🏆

[@stuffy24]

Thanks so much for the support

[@leonardocanciani7983]

hi brother, your videos are crazy, thanks for making them

[@iccanui9053]

Thanks a lot man. You sure helped me learn a bunch in this one.

[@stuffy24]

Thank you!

[@dheerajnunni8611]

thanks man ..reallly appreciate this!

[@themistoclesnelson2163]

Thanks. This was very helpful!.

[@andrewrx88]

thank you for giving the finer details!

[@stuffy24]

Thank you for the kind words

[@RaEndymion]

Thanks for another great video, my dude.

[@JCut323]

Great vids. It would be nice if you didn't worry about time I'd rather watch a longer video if that means I learn more. Also food for thought, as a beginner, I wish we didn't worry so much about "spoon feeding" answers for everything. In school, teachers taught us HOW to run mathematical equations, step by step, and explained WHY it works the way it does. The most important part was repitition and for us to show our work, that way we understood what we were doing. The worst teachers were the ones that told you to look it up in your text book and sat back in their chairs. In the cyberworld it makes sense that we should learn to be fully independent to find our own information as there is too much to learn. However, in the greater scheme of things, I think it would benefit us all if we focused more on collaboration and understanding the fundamentals as we make it easier and easier to attract more talent. edit: P.S. thanks to your walkthrough, I was able to accomplish the Capstone without watching the rest. However, that's not to say I'd recommend leaving it out as a final challenge to others. I still appreciated having the fact that I could reference the capstone walkthrough if necessary to help expedite the learning. Thanks again for the vid!

[@stuffy24]

I agree wholeheartedly with this idea the problem is realistically most people have short attention spans. You can see the analytics on KZbin and unfortunately longer videos equals less liked by the masses. This is why for the people that want to learn more I do the Livestreams in the discord and I do the Patreon videos for whatever topics they want. Its not perfect and I do agree finding that balance would be perfect! I just have to keep working on it. Thanks so much!

[@demonview6075]

You're a legend dude - appreciate your help

[@stuffy24]

Appreciate you!

[@marcustorner5908]

You are awesome, thank you!

[@stuffy24]

Thanks man!

[@comradedad]

I'm really enjoying your content man! The explanations are great and you have a great workflow for explaining what you're doing. I am curious though, why are you not doing this with a virtual machine? Keep it up!

[@stuffy24]

Thank you! I do a lot with my virtual machines but try hack me boxes I always do the videos with the attack box so that anyone watching can replicate my exact steps and not have to worry about certain versions of installs etc

[@tathagataroy9650]

Frank's password's hash value is upto LR1

[@mn.raunaq]

awesome content!

[@ragtaghero84]

although i'm sure i'm older than you: i wanna be like you when I grow up. mad skills!

[@stuffy24]

Appreciate it. I'm older than I look though lol

[@lamsiahkim5767]

You rock dude!

[@stuffy24]

Thank you!

[@jonathandwyer549]

Thank you

[@stuffy24]

Thank you for the support!

[@user-dl6zl8su1f]

Thanks for usefull content, and you have a good dog

[@stuffy24]

Thanks!

[@SanjinDedic]

Hey I love your content, seriously my favourite cybersec walkthroughs. I am planning on doing walkthoughs of picoCTF as I am currently teaching those to high school students I think it would be a lot more fun to do them on Zoom as a collaboration with another KZbinr. My freelancer can then do the editing and we both get polished content for our channels. Let me know if you are up for it

[@stuffy24]

Add the discord and add me and dm me

[@SanjinDedic]

@@stuffy24 done

[@pepeegrillo8934]

I had a lot of problems with the virtual machine. despite that, your explanation actually put me in orbit ps: love your dogs

[@stuffy24]

Thank you man!

[@Raferoll]

long videos are just fine ;)

[@kyleweeks4242]

I hope you don't mind if I ask a couple of questions. I'm having trouble in the crontab section. I tried editing the test.sh file with nano. I tried doing what you did with vim but I was having trouble exiting vim. I heard you say esc then w then q. I tried it and just got stuck in vim. Do I have to use vim for rewriting the test.sh file? Also if I'm incorrectly entering keys to exit vim, can you reiterate? Also I really appreciate you content! I try to do it all myself until I'm stuck, but your brain has helped me sooo much!

[@stuffy24]

Thank you for the comment no worries, you can use any text editor to edit the file I just happen to use vim. So with vim you hit escape to get to the command input then you type wq enter as the command. Let me know if that works for you!

[@kyleweeks4242]

@@stuffy24 I appreciate the reply! It took me a bit but I figured it out. Turns out I had to hit esc and then type : followed by the w q and enter. Hopefully this can help someone else. Also when I get paid be ready to have a new patreon follower!

[@stuffy24]

@@kyleweeks4242 love it! That's what it's all about is helping others !

[@MlodyKsiaze777]

I have a question, how much time do you think it takes to get to grips with this room, I've been learning from scratch and I've only been learning for the 2nd week and I'm wondering if I haven't made progress too soon, because there are quite advanced things here, what rooms should he do in advance? I did Introduction to Cyber Security and Pre Security, is that enough?

[@stuffy24]

Linux as a whole takes years so I wouldn't beat yourself up! Privelage escalation is all about knowing the systems so the more you administrate them the more you will know. Take your time and learn at your own pace

[@MlodyKsiaze777]

​@@stuffy24 what rooms should I do in advance? I did Introduction to Cyber Security and Pre Security,what rooms would you recommend for a beginner, I would like to become a penetration tester in future,How would you recommend learning for someone from 0 ?

[@stuffy24]

@@MlodyKsiaze777 you can join the discord and some of the folks can give you guidance and I can give you some resources.

[@drewwagner8245]

You can copy/paste things to the attack box clipboard. There's a little slider on the left-hand side of the attack box about half way between top and bottom. Open it and click "clipboard" then you can paste something from your machine to the attack box, or copy/paste something from the attack box to your machine. Hope that makes sense.

[@stuffy24]

Ya it does. I use it a lot in my newer videos! Thanks for the help !

[@drewwagner8245]

@@stuffy24 alright. I'm sure i'll see your new videos as i make my way through thm and hackthebox. you've been a lot of help for me. Do you have a degree in computer science or cyber security? I'll be going to school soon and I'm trying to figure out which would be the best degree for an eventual career in pentesting.

[@stuffy24]

@@drewwagner8245 hey thank you so much! I do have a degree in cyber security. I think it all depends on what interests you most

[@drewwagner8245]

@@stuffy24 Do you ever feel like you wish you would've gone for a computer science degree to help with all the code we see while doing cyber sec?

[@stuffy24]

@@drewwagner8245 that's a good question but no I don't at all but that's because when I got my degree I was already years into the field so I had already learned the things a cs degree would teach me

[@iCyberVenom]

So...the target's version of GLIBC is older (2.31) than the attacker's version of GLIBC (2.4). This prevents me from running the nfs executable on the target. Since I don't yet have root privileges to update GLIBC on the target, I was unable to gain root access and obtain the flag7.txt Part of me thought I could recompile nsf.c on attacker using the target's version of GLIBC, but I'm not sure how to rollback GLIBC on attacker. I'd have to research more. Any pointers? Surely I'm either missing something or there's a way around this.

[@stuffy24]

Id have to look more into it. Your using the attack box they provide right?

[@iCyberVenom]

@@stuffy24 Well...I'm using the Kali Linux box they provide. Does it make a difference? I would assume both Kali Linux and Attack Box they provide would be updated, but you know what happens when you make assumptions! I'll test on Attack Box and see if that works. Thanks for your reply.

[@stuffy24]

@@iCyberVenom usually they tell you if you need to use the Kali box for something. Let me know if the attack box works?

[@takashidoyama9333]

Had the same issue. Compiling worked when using the attack box (gcc version 9.4.0) but didn't work on my own Kali (gcc version 12.2.0)

[@iCyberVenom]

​@@takashidoyama9333 And there it is! haha I eventually figured it out, but boy was that annoying while navigating the issue.

[@Rogerson112]

Hey can you tell me what you do for a living? You're pentester or SOC or kinda like that

[@stuffy24]

I do work in cybersecurity yes.

[@silversilver-tj6np]

thx bro

[@fernandovega4816]

Task 9 is not working for me. I edit the backup.sh file using nano to contain the reverse shell code as mentioned in the task and it doesn't work as a Cron job. When I enter the script directly on the command line it works just fine and the reverse shell connects back to the attacking machine. How do you go about triggering the Cron job?

[@stuffy24]

Cron jobs are scheduled so it will auto trigger at a certain point

[@fernandovega4816]

@@stuffy24 thanks for your reply, I’m liking your vids and they’ve been helpful. The problem was actually that I didn’t do chmod +x on the file.

[@stuffy24]

@@fernandovega4816 thank you! Nice catch and glad you fixed it

[@h4cker]

to do do do ... tu do du... to du du... 😂😂. Now It becomes my habit.

[@777jac]

Im having a problem at task 11, mount -o rw mount: only root can use" --options" option

[@stuffy24]

Can you hop in the discord and try and troubleshoot? It's too hard to tell just with that info.

[@777jac]

@@stuffy24 Ok, I will join the discord. Thanks

[@sleepyjoe3970]

incase anyone else runs into this problem. Make sure you're running mount -o rw command on your attackbox and not on karen's ssh connection

[@Boolap1337]

Regarding cron jobs - During a real pen test engagement editing existing running cron jobs cant rly be appreciated right? Super good and informative content.

[@stuffy24]

This all depends on your scope. Some companies do want to see this done but your right it is sketchy

[@Boolap1337]

@@stuffy24 With that being said, If I do find a vulnerability within a cron job and being able to edit a existing running job I might wanna take it with the customer first... :) Thanks for the fast answer.

[@stuffy24]

@@Boolap1337 yes absolutely lol most the time you will have consistent contact with the customer POC and before you do anything like that will be letting him know or asking

[@joshh4005]

Is there a Linux priv ESC cheat sheet somewhere?

[@stuffy24]

There are a bunch of them just Google it. Nothing specific I use. Most are just my homemade ones I use.

[@joshh4005]

@@stuffy24 is using linpeas maybe bad practice for a beginner

[@stuffy24]

@@joshh4005 I wouldn't say bad practice it's a good tool that finds things you may forget but I think take all the things its looking for and check manually will teach you much more! Also keep in mind linpeas will almost always be caught in today's environments if you don't change things

[@Alternosphere]

get the doggo involved lol what its name?

[@stuffy24]

Haha I have 3 actually so they would get too involved!

[@azerty2385]

someone managed to install gcc co-compiler on linux target?

[@stuffy24]

This video was a long time ago I don't remember what I had to do

[@azerty2385]

@@stuffy24 thank you anyway for answering me, it was a bug because gcc was installed on the target by default

[@ferasalfarsi897]

I wish you zoomed in the words and letters are very small!

[@stuffy24]

Yep this is an older video. I do that in my newer videos

[@ferasalfarsi897]

I appreciate your hard working @@stuffy24

[@bobbyaxe5028]

Yo, I kinda like how you don't answer everything. It's a reminder that I gotta really try to take it all in and jot down some good notes with Cherry Tree.

[@stuffy24]

Appreciate you my man

[@cilasafonso6408]

Plz, writeups New room Windows Privilegie Escalation

[@stuffy24]

I plan on it but I will finish the defense path first since people are waiting on that. I upload quite often so shouldn't take long.

[@stuffy24]

Get 20% OFF @manscaped + Free Shipping with promo code STUFFY24 at MANSCAPED.com! #ad #manscapedpod

[@michazborowski2637]

You explain it better than tryhackme's description

[@stuffy24]

To be fair they have to use just text where I can verbalize it but thank you so much for the support