Now, again, I want to stress that we go through the skill
with the mindset of both a pen tester
and a security technician.
Because as we pop over to our lab here,
we're in our Ubuntu box,
and I have two files that will be ready for us
on the right side called files and directories.
Now, I'm going to zoom in for us here real quick
and show us what's going on.
And what we're doing is we're taking a look
to find files that have permissions
that allow us to basically write to them
regardless of the user based on their file permissions.
And I have this code in the code box below this video.
And what we're going to do is open up our files
text document here for a second.
And these are all the files in the Ubuntu system
running that command without pseudo permissions
that shows us where all the files are that we can write to.
Now, I'm going to do a proof of concept here
for us real quick,
and look at under the PROC 2 folder
that number two attribute execute.
And we're going to go to our terminal here
and do it ls-la slash PROC slash two slash A-T-T-R
slash E-X-E-C.
And zoom in for us here real quick,
because you can see that this one
has attributes of right for everybody.
Now, what does this mean in particular?
Well, if there are cron jobs or other service files
or other important files to the operating system
on the system,
this right here would be one of the procedures
that we run on the actual targeted POSIX based system
when we first gain entry to it
to figure out where we're going to hide our code
and also our other executables
that we want to run in the future.
Up to this point in the course,
what we've been doing is forcing our way into the system.
And now we're in that part of the pentesting life cycle,
see, I told you we keep coming back to it,
where we look at persistence.
And the persistence of pentesting is that at any point,
if something is found,
let's say a backdoor like Netcat or something like that,
we can easily go in and find one of these files
to put in our code or whatever it may be
to be able to go through and have a backdoor
or other set of permissions or code.
And this file right here that exported
shows us all the files that have write capabilities to them.
And we could surely go through
because you see there's a lot of proc folder in there,
which means that is a process.
Now, just out of sheer curiosity,
let's see what processes are running.
And so I think we can just do a simple PS
and see that we have two PIDs
that are active under this user,
45452210, 22102.
Now using the command PS aux,
and I'll zoom in and show you what's going on here.
We can see all the actual jobs
that are running on the Linux Ubuntu here.
And you can see that in line two,
there is a PID number two.
And that we know that inside of POSIX based systems,
that anytime that there's a process ID,
there's going to be a folder associated with this.
And going back to our actual files,
that's exactly what's happening here
is that we're finding files inside of the process
that's running on the system concurrently
that has write permissions to this.
So what we're really worried about here
as a security technician and happy about as a pen tester
is the fact that all these files right here
inside the proc two folder are writable by anybody
and can be attacked while the process is running.
Because let's do a quick look inside that folder
using our GUI here real quick
and go into the actual other locations, Ubuntu,
and into the proc folder for number two.
And this is our process that's running behind the scenes.
And you can see here that there are many files
that can be called upon inside of that process.
Well, what's the actual process itself
is you can actually go in here
and get more details about that.
And inside the folder,
you can see that the ones with the Xs
have actual permissions to them.
But according to our files here,
our actual simple search that we did
without elevated permissions,
we now have access to write into files
that are in a running process.
And this, depending on the actual process,
let's say, go back to the window here for a second,
just find one that's running, that's identifiable.
And I'm taking a look at bash here
because that's the actual terminal window
that we have open right now.
And if you remember when we ran our PS originally,
it showed 4545 as a PID that's running under our user.
So we're logged in as learner, right?
Well, inside of our files here, wrong one,
we can see that 4545 has a bunch of files
inside the actual process ID folder
that have write permissions by everybody.
So we know the service is currently running.
We know that we can actually, as a pen tester,
go in and modify some of these files
because if the bash is still continued running,
then we have a possible way for us to gain persistence.