title: Bandit
weekday: Monday
date: 2020-07-27
tags:
- Journal/Tale
aliases:
- Bandit
- July 27th, 2020
- Monday July 27th 2020Bandit
Bandit 2
The easiest way to read a file beginning with a dash (-) is generally just to prefix it with a path; so, title: Read a file beginning with a dash (-)
aliases:
- Read a file beginning with a dash (-)
permalink: spells/read-a-file-beginning-with-a-dash
tags:
- Language/Bash
- HowTo
- Application/catRead a file beginning with a dash (-)
cat ./- reads a file called - in the current directory (as opposed to cat -, which tries to read from STDIN).
Bandit 13
The xxd command is actually pretty standard on Linux systems.tags:
- Application/xxd
- OS/Linuxxxd
# Create a hex dump of binary file $BINARY.
#
xxd $BINARY $HEXDUMP
# Reconstitute a binary file from a hex dump! Wow!
#
xxd -r $HEXDUMP $BINARY
Bandit 16
The permalink: spells/send-a-command-using-openssl
tags:
- Application/OpenSSL
- HowToSend a command using OpenSSL
echo "$TEXT" | openssl s_client $HOST:$PORT -ign_eof
-ign_eof keeps the s_client open on EOF, which can (does?) get sent after each command. This is necessary if you, say, want to read the connected server's respond to sending it $TEXT.
Bandit 26
The more command acts like cat whenever it can. The only way to force more into interactive mode is to make your terminal smaller than the number of lines in the file being displayed. Incidentally, this means that it's impossible to send commands to more when using it to display a one-line file. An editor can be invoked from more using If more can be run with NOPASSWD via sudo, then an admin shell can be achieved by using Exotic shells in /etc/passwd can also cause commands executed via ssh to fail for the same reason.tags:
- Application/more
- Application/cat
- Application/sudo
- AttackCycle/PrivEsc
- AttackCycle/Exploitationmore
v; by default this tries to invoke $VISUAL, and then $EDITOR, and then just Vi before giving up.! to invoke a command (!/bin/bash, etc.). Note, however, that this is just executing $SHELL -c $COMMAND, which can fail if $SHELL is set to something exotic in /etc/passwd.
If ViM can be run with NOPASSWD via sudo, then commands can be executed as admin using the However, if a non-standard shell is set in /etc/passwd, Vi and ViM may not be able to shell out with (Exotic shells in /etc/passwd can also cause commands executed via ssh to fail for the same reason.)permalink: spells/get-a-shell-from-vim
tags:
- Application/ViM
- AttackCycle/PrivEsc
- LoLBinsGet a shell from ViM
! prefix.:shell or execute shell commands with !. This is because these apps are attempting to execute $SHELL (in the case of :shell) or $SHELL -c $COMMAND (in the case of !).