48 lines
1.3 KiB
YAML
48 lines
1.3 KiB
YAML
id: privesc-mawk
|
|
|
|
info:
|
|
name: mawk - Privilege Escalation
|
|
author: daffainfo
|
|
severity: high
|
|
description: |
|
|
mawk is an efficient and fast implementation of the AWK programming language. It is designed to be smaller and faster than the original AWK implementation, making it suitable for large data processing tasks. mawk is commonly used for text processing and pattern scanning in shell scripts and command-line environments.
|
|
reference:
|
|
- https://gtfobins.github.io/gtfobins/mawk/
|
|
metadata:
|
|
verified: true
|
|
tags: code,linux,mawk,privesc
|
|
|
|
self-contained: true
|
|
code:
|
|
- engine:
|
|
- sh
|
|
- bash
|
|
source: |
|
|
whoami
|
|
|
|
- engine:
|
|
- sh
|
|
- bash
|
|
source: |
|
|
mawk 'BEGIN {system("whoami")}'
|
|
|
|
- engine:
|
|
- sh
|
|
- bash
|
|
source: |
|
|
sudo mawk 'BEGIN {system("whoami")}'
|
|
|
|
matchers-condition: and
|
|
matchers:
|
|
- type: word
|
|
part: code_1_response
|
|
words:
|
|
- "root"
|
|
negative: true
|
|
|
|
- type: dsl
|
|
dsl:
|
|
- 'contains(code_2_response, "root")'
|
|
- 'contains(code_3_response, "root")'
|
|
condition: or
|
|
# digest: 490a0046304402200f2fc2cb7ee4195d6ba84734e5816cd6344c1027d789617f593fd573a882798d0220456bbb1bff1ee4887264d39670a7bafd2d3e6e5714ac616b65454e26490b1c50:922c64590222798bb761d5b6d8e72950 |