id: privesc-mawk

info:
  name: mawk - Privilege Escalation
  author: daffainfo
  severity: high
  description: |
    mawk is an efficient and fast implementation of the AWK programming language. It is designed to be smaller and faster than the original AWK implementation, making it suitable for large data processing tasks. mawk is commonly used for text processing and pattern scanning in shell scripts and command-line environments.
  reference:
    - https://gtfobins.github.io/gtfobins/mawk/
  metadata:
    verified: true
    max-request: 3
  tags: code,linux,mawk,privesc,local

self-contained: true
code:
  - engine:
      - sh
      - bash
    source: |
      whoami

  - engine:
      - sh
      - bash
    source: |
      mawk 'BEGIN {system("whoami")}'

  - engine:
      - sh
      - bash
    source: |
      sudo mawk 'BEGIN {system("whoami")}'

    matchers-condition: and
    matchers:
      - type: word
        part: code_1_response
        words:
          - "root"
        negative: true

      - type: dsl
        dsl:
          - 'contains(code_2_response, "root")'
          - 'contains(code_3_response, "root")'
        condition: or
# digest: 4a0a0047304502200df72b2069096e548940fff30c33212d8fb9d02c2ca03323f5d7bbee8e35287a022100f1f693cd49803f304a8b40d5e633bbbeb5f9e58ded1142fbe9959879e2dd6a2d:922c64590222798bb761d5b6d8e72950