From 99a572b7d9c400c2080b1b4e04f8a2ad649db3b2 Mon Sep 17 00:00:00 2001 From: SleestakOverflow <75267249+sleestakoverflow@users.noreply.github.com> Date: Mon, 15 Feb 2021 21:49:13 -0600 Subject: [PATCH] Create sg.md Adding the "sg" binary which allows command execution under a "different" group ID. However, it can be used to break out of restricted environments by using a user's own group ID. --- _gtfobins/sg.md | 19 +++++++++++++++++++ 1 file changed, 19 insertions(+) create mode 100644 _gtfobins/sg.md diff --git a/_gtfobins/sg.md b/_gtfobins/sg.md new file mode 100644 index 0000000..553d4eb --- /dev/null +++ b/_gtfobins/sg.md @@ -0,0 +1,19 @@ +--- +functions: + shell: + - description: Commands can be run if the current user's group is specified, therefore no additional permissions are needed. + code: | + GROUPNAME=users + sg $GROUPNAME -c "/bin/sh" + command: + - description: Commands can be run if the current user's group is specified, therefore no additional permissions are needed. + code: | + COMMAND=whoami + GROUPNAME=users + sg $GROUPNAME -c $COMMAND + sudo: + - description: Any group can be specified as the user will have root permissions. + code: | + GROUPNAME=users + sudo sg $GROUPNAME -c "/bin/sh" +---