How to use File read escalation about gtfobins.github.io HOT 4 CLOSED

Hey! That's expected of course, none of the commands listed here will allow you to escalate your privileges in an unintended way, meaning that they're not exploits, that just how they work, there's nothing to fix from the vendor perspective. The goal of GTFOBins is to collect some ways a binary/script can be used to perform some action.

Now, cat is a bit of a stretch here, because yeah, cat reads file right? But it has been added for completeness, and as you can image makes little sense in you just run it from a shell.

(As a side note, we often use the term "restricted shell" in a broad way, but restricted shells though, are particular feature that some shells have, think of it of a very loose jailed environment, and some of the techniques listed here allow to bypass it, but it's quite trivial and not the whole point. See RESTRICTED SHELL in man bash.)

Take for example a scenario in which you have some limited form of command execution via, say, a vulnerable PHP web application, where you only have some commands available, you want to read some file, so you query GTFOBins and you obtain a list of binaries, cat is one of them. So you can use it to reach your goal. Again, the fact that cat reads files is not big news, but still, it's something that GTFOBins should return as an answer to that query.

I hope this makes sense, feel free to ask otherwise. :)

from gtfobins.github.io.

Hello,

Many thanks for your answer! 👍🏽
I read up about RESTRICTED SHELL and it makes everything clear now.

Another question:
If you put in cat in the list, is there a reason why you didn't put ls as well?
Using ls can also list up all directories and files outside of the restricted dir.

from gtfobins.github.io.

If you put in cat in the list, is there a reason why you didn't put ls as well?
Using ls can also list up all directories and files outside of the restricted dir.

Yeah, as you can imagine the list of functions supported by GTFOBins is only a small subset of all the possible functions that are actually useful in a pentest/hacking context, and the definition is often quite blurry, it would be realistically impossible to map precisely all the functions provided by those binaries.

Also, you might have noticed that there's no file copy, and for the same reason; in those cases we usually just use file write. And same goes to a certain extent with ls: file list would probably be too much, I guess that could be reduced to a file read.

The list of functions is not fixed though but we're quite conservative about it.

from gtfobins.github.io.

Ok, it's clear now.
Many thanks! 😁

from gtfobins.github.io.