Skip to content

Add du#586

Open
Thegrasscutter wants to merge 1 commit into
GTFOBins:masterfrom
Thegrasscutter:master
Open

Add du#586
Thegrasscutter wants to merge 1 commit into
GTFOBins:masterfrom
Thegrasscutter:master

Conversation

@Thegrasscutter

Copy link
Copy Markdown

du is a standard coreutils utility for estimating file space usage, commonly available on all Unix-like systems.

The --files0-from option reads a NUL-delimited list of file paths from a specified file. Each entry is stat'd and measured. Non-existent paths are emitted as error messages to stderr, leaking each line of the input file.

Content is leaked via stderr error messages of the form du: cannot access '<file contents>': No such file or directory.

@Thegrasscutter

Copy link
Copy Markdown
Author

Example:

$ cat /root/flag.txt
cat: /root/flag.txt: Permission denied
$ sudo du --files0-from=/root/flag.txt
du: cannot access 'Successful arbitrary file read. FLAG{HERE_IS_A_FAKE_FLAG}'$'\n': No such file or directory

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant