Catalog GTFOBins

GTFO · Tool

wireshark

4 techniques LinuxGTFOBins GPL-3.0

file-write

File WritePrivilege Escalation Linux

This technique can be used to write arbitrary files, i.e., the dump of one UDP packet. After starting Wireshark, and waiting for the capture to begin, deliver the UDP packet, e.g., with `nc` (see below). The capture then stops and the packet dump can be saved: 1. select the only received packet; 2. right-click on "Data" from the "Packet Details" pane, and select "Export Packet Bytes..."; 3. choose where to save the packet dump.

wireshark -c 1 -i lo -k -f 'udp port 12345' &
echo DATA | nc -u 127.127.127.127 12345
Context
sudo
Native
file-write
MITRE
T1565

file-write

File Write Linux

This technique can be used to write arbitrary files, i.e., the dump of one UDP packet. After starting Wireshark, and waiting for the capture to begin, deliver the UDP packet, e.g., with `nc` (see below). The capture then stops and the packet dump can be saved: 1. select the only received packet; 2. right-click on "Data" from the "Packet Details" pane, and select "Export Packet Bytes..."; 3. choose where to save the packet dump.

wireshark -c 1 -i lo -k -f 'udp port 12345' &
echo DATA | nc -u 127.127.127.127 12345
Context
unprivileged
Native
file-write
MITRE
T1565

inherit ← lua

Reverse/Bind ShellFile DownloadFile ReadFile WriteExecutionFile UploadPrivilege Escalation Linux

This requires GUI interaction. Start Wireshark, then from the main menu, select "Tools" -> "Lua" -> "Evaluate". A window opens that allows to execute Lua code.

wireshark
Context
sudo
Native
inherit, from:lua

inherit ← lua

Reverse/Bind ShellFile DownloadFile ReadFile WriteExecutionFile Upload Linux

This requires GUI interaction. Start Wireshark, then from the main menu, select "Tools" -> "Lua" -> "Evaluate". A window opens that allows to execute Lua code.

wireshark
Context
unprivileged
Native
inherit, from:lua