nuclei-templates/code/privilege-escalation/linux/binary/privesc-cdist.yaml

49 lines
1.2 KiB
YAML

id: privesc-cdist
info:
name: Cdist - Privilege Escalation
author: daffainfo
severity: high
description: |
cdist is a free software configuration management tool for Unix-like systems. It manages nodes over SSH using the Bourne Shell, and does not require any additional software to be installed on target nodes.
reference:
- https://gtfobins.github.io/gtfobins/cdist/
metadata:
verified: true
max-request: 3
tags: code,linux,cdist,privesc,local
self-contained: true
code:
- engine:
- sh
- bash
source: |
whoami
- engine:
- sh
- bash
source: |
cdist shell -s whoami
- engine:
- sh
- bash
source: |
sudo cdist shell -s whoami
matchers-condition: and
matchers:
- type: word
part: code_1_response
words:
- "root"
negative: true
- type: dsl
dsl:
- 'contains(code_2_response, "root")'
- 'contains(code_3_response, "root")'
condition: or
# digest: 4a0a00473045022067a276a4edab8499fe86d5520587f431af94088fec0bb96acff43c6fcc88233b022100f40168eb0bdde93de1a6a747737c96db048ef16ffa8eb6666722301eb3f0da4e:922c64590222798bb761d5b6d8e72950