wireshark | GTFOBins

.. / wireshark

Sponsor Fork Star

File write

This executable can write data to local files.

Comment

This technique can be used to write arbitrary files, i.e., the dump of one UDP packet.

After starting Wireshark, and waiting for the capture to begin, deliver the UDP packet, e.g., with nc (see below). The capture then stops and the packet dump can be saved:

select the only received packet;
right-click on “Data” from the “Packet Details” pane, and select “Export Packet Bytes…”;
choose where to save the packet dump.

Unprivileged

This function can be performed by any unprivileged user.

wireshark -c 1 -i lo -k -f 'udp port 12345' &
echo DATA | nc -u 127.127.127.127 12345

Sudo

This function is performed by the privileged user if executed via sudo because the acquired privileges are not dropped.

Remarks

If there are environment variables involved, they must be passed via sudo VAR=value ... or exported then sudo -E ....

wireshark -c 1 -i lo -k -f 'udp port 12345' &
echo DATA | nc -u 127.127.127.127 12345

Inherit

This executable can inherit functions from another.