pwncat/gtfobinstest.py

#!/usr/bin/env python3


from pwncat.gtfobins import *
import subprocess


def which(path: str, quote=False):
    try:
        output = subprocess.check_output(f"which {path}", shell=True)
    except subprocess.CalledProcessError:
        return None

    return output.decode("utf-8").strip()


gtfo = GTFOBins("data/gtfobins.json", which)


binary_to_test = "curl"
# capabilities_to_test = Capability.SHELL
capabilities_to_test = Capability.WRITE
# capabilities_to_test = Capability.WRITE
our_shell = "/bin/bash"

binary = gtfo.find_binary(binary_to_test)
print(binary)
print(vars(binary))

methods = binary.iter_methods(
    which(binary_to_test), caps=capabilities_to_test, stream=None
)
for method in methods:
    # print(method)
    # print(method.build(shell=our_shell, suid=True))
    print(method.build(lfile="/etc/shadow", suid=True)[0])
    # print(method.build(lfile="/tmp/test", data="hello")[0])

# all_binaries = list(gtfo.iter_methods(Capability.SHELL))
# print(all_binaries[0].build(shell="/bin/bash", suid=True))