Real quick, I noticed there was something I haven't really covered yet in this course, and that is the sudo-i command.
And this is because I ran across an issue where I was trying to demonstrate something like change directory,
and I can't use sudo space cd etc etc. So I'm going to open up a sudo shell, so to speak.
And to do that, I'm just simply typing sudo-i.
And this will open up bash within as root.
And you can see the difference here. We've gone from learner at learner to root at learner.
So now everything I'm doing is at root. Be cautious when you run this.
The reason I want to show you this is because I've actually created a user, then deleted it,
and then went through and created some files under that user while it was there.
And we're going to be demonstrating unknown ownership of files and folders.
And there's one folder in particular with a file in it called storage at the root level.
So to get there, we're going to go into cd space storage.
And this is the actual folder itself that I created using the learner to account that's now deleted.
If I do LS in there, you can see that I created a file called learner two.
And that user has since been deleted after the file was created.
Now, we know that if a file is created on a system just because the user gets deleted or the group that's affiliated with that user,
it doesn't mean that the file or contents of that file are going to get deleted as well with it.
And that's because, you know, data is data.
And if we got rid of all files that belong to previous users, then there would be a whole lot of stuff missing.
So why is this important?
Well, sometimes you can actually run across files that don't have an owner associated with it inside of POSIX based systems.
Same thing for inside of Windows, except inside of Linux, for example, it's a little bit more creative in how to find those.
Now, right off the bat, we could just simply type find slash no user commands below, by the way.
And I totally didn't typo there with that space of breaking the video.
But what you're seeing here now is that we were looking on the root level for dash no user, meaning no user associated with a particular file.
And we're using it on the entire system itself.
And you can see that we start off right away with storage and home learner, too.
So there is also a folder in here called home slash learner, too.
And that was the actual user environment and directories associated with that learner to user that I created and deleted.
Now, what does all this really mean?
It means we can create a user account with a specified user ID to take over those unowned files and folders on the actual system that we're attacking or taking a look at.
Now, this can open up a whole different can of worms in Pandora's shoe box.
So I want you to keep that mighty security advance watching this.
But as a pen tester, we can do we can go about doing this and actually help us find different pieces of information that will play into the next part of this skill.
But more importantly, gain access to stuff that was previous lost.
For example, let's say that there's a folder that has a bunch of programs in it or scripts for the administration or employee information and testers here.
We can actually create that user specified user ID and go in and retrieve that information to gain more persistence, pivot, be do lateral movements, movements, etc.
So this is really something to keep an eye on in case you're running across different files that you find with no user name.
You could start by doing a deep dive into searching for those you IDs.
Now, I've cleared out our terminal window and we're actually going to try to do this.
And so one thing we're taking a look at here is actually going in and reviewing data that we have access to as regular users.
I know I'm in pseudo dash I right now. Bear with me.
But we also know that the password file in the Etsy folder can be viewed by anybody. Right.
So let's go ahead and do a cat slash Etsy slash password.
And what this will do is show us all the users on the system and more importantly, the actual user IDs.
Now, again, we're doing this with assumptions included because learner tubes no longer in here. Right.
But if we zoom in and we could see that the learner account was made with user ID one thousand.
So it would stand to reason that the next user account created on the system would be user ID one thousand one.
Well, how do we actually verify this and test to see if that's true?
One thing we could do is type in find an inside of the storage folder we have.
As an example, we're going to type in you ID one thousand one.
And we're also going to type in our continuing of two slash dev slash no.
And we can see there that when we do get results, meaning that a user ID of one thousand one was used to be able to create these files inside the folder.
So can we create a user on this particular system with a specified ID of one thousand one?
And the answer to that mysterious question is absolutely.
Now, I've dumped out of pseudo dash I. You can see that I have the green learner at learner back again.
And this is because I want to get familiar or use pseudo when I do this, because we're going to be using a pseudo user ad.
And this time dash you one thousand one specifying the actual user ID of the actual user that we found with the unknown or no user assigned files. Right.
So in this particular case, we're going to call it one thousand one. We're going to give it dash M dash S.
And this is default stuff for like how it logs in and which shell it's going to be using.
We're going to call this user instead of learner two.
We're going to call this Debbie because I like me some Debbie sometimes.
I am a dummy myself, but we're going to do that.
And we've also now that it's created, we want to add a password dummy.
So pseudo password dummy.
And we're going to give it just password.
Bad password P at dollar dollar w o r d.
I overthought it. It's password all lowercase.
So now the user dummy should have a user ID of one thousand one and a password of password.
Let's do a cat to Etsy slash password file again.
And you could see there on that bottom line as I highlight and get ready to zoom in for you right here.
There we go. That we have dummy with one thousand one is user ID.
Now, when we log in for the first time with the dummy account, it will create our home folders and all that great stuff under dummy.
We should be able to access learner to here.
We are logged into the dummy account and show you there's nothing up my sleeve.
We have who am I, dummy.
And so I'm going to minimize this terminal window for a second.
And you can see that I am in the file explorer for the system itself.
And I can go into storage. Not a problem.
And while I may have modified some of the permissions on the actual storage folder to be able to do my previous examples,
I can go into the actual learner file, which I didn't modify and see you found me.
And that's because I have the same you ID as learner to,
which means that I've bypassed some of the security measures because this file in particular lost ownership
because the user account was deleted and therefore it had no user affiliated with it.
Now, you may be thinking to yourself, I don't know.
Seems pretty suspicious that that one file was there for you.
And you'd be correct to think that because you want verification of proof.
So let's go into the actual home directory itself on the system slash home.
And then you see here we have dummy learner and learner to.
And you'll notice that learner to doesn't have a red X on it like learner does.
That's because with no modifications whatsoever, just because we have that user ID of 1001,
we're now able to access learner to and go into all the files and folders that learner to used to have before that account was deleted.