From 72c489bffa8a7434c74e9ea2ae549c513c5c8a16 Mon Sep 17 00:00:00 2001 From: sk3l10x1ng Date: Fri, 5 Feb 2021 13:34:14 +0100 Subject: [PATCH 1/3] Add vipw --- _gtfobins/vipw.md | 13 +++++++++++++ 1 file changed, 13 insertions(+) create mode 100644 _gtfobins/vipw.md diff --git a/_gtfobins/vipw.md b/_gtfobins/vipw.md new file mode 100644 index 0000000..343c081 --- /dev/null +++ b/_gtfobins/vipw.md @@ -0,0 +1,13 @@ +--- +functions: + + file-write: + - code: | + vipw --passwd + vipw --shadow + suid: + - code: | + ./vipw --passwd + sudo: + - code: sudo vipw --shadow +--- From 4f4207be130913e2d769101fa01cc821a8cc154f Mon Sep 17 00:00:00 2001 From: Andrea Cardaci Date: Fri, 5 Feb 2021 13:37:16 +0100 Subject: [PATCH 2/3] Cleanup and clarify vipw --- _gtfobins/vipw.md | 11 +++-------- 1 file changed, 3 insertions(+), 8 deletions(-) diff --git a/_gtfobins/vipw.md b/_gtfobins/vipw.md index 343c081..da55154 100644 --- a/_gtfobins/vipw.md +++ b/_gtfobins/vipw.md @@ -1,13 +1,8 @@ --- +description: This command allows to edit some designated files (`/etc/passwd`, `/etc/group`, `/etc/shadow` and `/etc/gshadow`) safely by spawning the default editor (falling back to [`vim`](/gtfobins/vim/), other functions may apply). Despite requiring superuser privileges to run, the editor is executed as the unprivileged user when run as SUID or with `sudo`. functions: - - file-write: - - code: | - vipw --passwd - vipw --shadow suid: - - code: | - ./vipw --passwd + - code: ./vipw sudo: - - code: sudo vipw --shadow + - code: sudo vipw --- From a3f2107360ee6b96599b6161e8a85cabc97f0cde Mon Sep 17 00:00:00 2001 From: Andrea Cardaci Date: Fri, 5 Feb 2021 13:38:30 +0100 Subject: [PATCH 3/3] Clone vipw to vigr as it is just a symlink --- _gtfobins/vigr.md | 8 ++++++++ 1 file changed, 8 insertions(+) create mode 100644 _gtfobins/vigr.md diff --git a/_gtfobins/vigr.md b/_gtfobins/vigr.md new file mode 100644 index 0000000..a755222 --- /dev/null +++ b/_gtfobins/vigr.md @@ -0,0 +1,8 @@ +--- +description: This command allows to edit some designated files (`/etc/passwd`, `/etc/group`, `/etc/shadow` and `/etc/gshadow`) safely by spawning the default editor (falling back to [`vim`](/gtfobins/vim/), other functions may apply). Despite requiring superuser privileges to run, the editor is executed as the unprivileged user when run as SUID or with `sudo`. +functions: + suid: + - code: ./vigr + sudo: + - code: sudo vigr +---