From 9466e495d600ed36afdbcf4bfa8c0b7636a8a158 Mon Sep 17 00:00:00 2001 From: Milana Date: Wed, 19 Feb 2025 09:58:13 +0300 Subject: [PATCH 1/6] =?UTF-8?q?=D0=98=D0=B7=D0=BC=D0=B5=D0=BD=D0=B5=D0=BD?= =?UTF-8?q?=D0=B8=D0=B5=201=20=D0=B2=20README.md=20=D0=B2=20branch1?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit --- README.md | 61 +------------------------------------------------------ 1 file changed, 1 insertion(+), 60 deletions(-) diff --git a/README.md b/README.md index 1844d97b..e2629ab9 100644 --- a/README.md +++ b/README.md @@ -1,60 +1 @@ -# Traitor - -Automatically exploit low-hanging fruit to pop a root shell. Linux privilege escalation made easy! - -Traitor packages up a bunch of methods to exploit local misconfigurations and vulnerabilities in order to pop a root shell: - -- Nearly all of [GTFOBins](https://gtfobins.github.io/) -- Writeable docker.sock -- CVE-2022-0847 (Dirty pipe) -- CVE-2021-4034 (pwnkit) -- CVE-2021-3560 - -![Demo](demo.gif) - -It'll exploit most sudo privileges listed in GTFOBins to pop a root shell, as well as exploiting issues like a writable `docker.sock`, or the recent dirty pipe (CVE-2022-0847). More routes to root will be added over time too. - -## Usage - -Run with no arguments to find potential vulnerabilities/misconfigurations which could allow privilege escalation. Add the `-p` flag if the current user password is known. The password will be requested if it's needed to analyse sudo permissions etc. - -```bash -traitor -p -``` - -Run with the `-a`/`--any` flag to find potential vulnerabilities, attempting to exploit each, stopping if a root shell is gained. Again, add the `-p` flag if the current user password is known. - -```bash -traitor -a -p -``` - -Run with the `-e`/`--exploit` flag to attempt to exploit a specific vulnerability and gain a root shell. - -```bash -traitor -p -e docker:writable-socket -``` - -## Supported Platforms - -Traitor will run on all Unix-like systems, though certain exploits will only function on certain systems. - -## Getting Traitor - -Grab a binary from the [releases page](https://github.com/liamg/traitor/releases), or use go: - -``` -CGO_ENABLED=0 go get -u github.com/liamg/traitor/cmd/traitor -``` - -For go1.18: - -``` -CGO_ENABLED=0 go install github.com/liamg/traitor/cmd/traitor@latest -``` - -If the machine you're attempting privesc on cannot reach GitHub to download the binary, and you have no way to upload the binary to the machine over SCP/FTP etc., then you can try base64 encoding the binary on your machine, and echoing the base64 encoded string to `| base64 -d > /tmp/traitor` on the target machine, remembering to `chmod +x` it once it arrives. - -## In The News -- 20/06/21: [Console 58](https://console.substack.com/p/console-58) - Awesome newsletter featuring tools and beta releases for developers. -- 28/04/21: [Intigriti Bug Bytes #120](https://blog.intigriti.com/2021/04/28/bug-bytes-120-macos-pwned-homebrew-rce-the-worlds-shortest-backdoor/) - Recommended tools -- 09/03/21: [Hacker News thread](https://news.ycombinator.com/item?id=26224719) +"Изменение 1 в branch1" From f40558955c1aaf3a28697093982492edc4114afc Mon Sep 17 00:00:00 2001 From: Milana Date: Wed, 19 Feb 2025 09:58:37 +0300 Subject: [PATCH 2/6] =?UTF-8?q?=D0=98=D0=B7=D0=BC=D0=B5=D0=BD=D0=B5=D0=BD?= =?UTF-8?q?=D0=B8=D0=B5=202=20=D0=B2=20README.md=20=D0=B2=20branch1?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit --- README.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/README.md b/README.md index e2629ab9..173d49bc 100644 --- a/README.md +++ b/README.md @@ -1 +1 @@ -"Изменение 1 в branch1" +"Изменение 2 в branch1" From cf2df2a69edc0e672f90f337b984e286aac1e47c Mon Sep 17 00:00:00 2001 From: Milana Date: Wed, 19 Feb 2025 09:58:59 +0300 Subject: [PATCH 3/6] =?UTF-8?q?=D0=98=D0=B7=D0=BC=D0=B5=D0=BD=D0=B5=D0=BD?= =?UTF-8?q?=D0=B8=D0=B5=203=20=D0=B2=20README.md=20=D0=B2=20branch1?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit --- README.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/README.md b/README.md index 173d49bc..d6a7000a 100644 --- a/README.md +++ b/README.md @@ -1 +1 @@ -"Изменение 2 в branch1" +"Изменение 3 в branch1" From 8f191e7eccf657fd6a6c1a66ff56b96bd3799ad0 Mon Sep 17 00:00:00 2001 From: Milana Date: Wed, 19 Feb 2025 09:59:29 +0300 Subject: [PATCH 4/6] =?UTF-8?q?=D0=98=D0=B7=D0=BC=D0=B5=D0=BD=D0=B5=D0=BD?= =?UTF-8?q?=D0=B8=D0=B5=201=20=D0=B2=20README.md=20=D0=B2=20branch2?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit --- README.md | 61 +------------------------------------------------------ 1 file changed, 1 insertion(+), 60 deletions(-) diff --git a/README.md b/README.md index 1844d97b..b467a5b6 100644 --- a/README.md +++ b/README.md @@ -1,60 +1 @@ -# Traitor - -Automatically exploit low-hanging fruit to pop a root shell. Linux privilege escalation made easy! - -Traitor packages up a bunch of methods to exploit local misconfigurations and vulnerabilities in order to pop a root shell: - -- Nearly all of [GTFOBins](https://gtfobins.github.io/) -- Writeable docker.sock -- CVE-2022-0847 (Dirty pipe) -- CVE-2021-4034 (pwnkit) -- CVE-2021-3560 - -![Demo](demo.gif) - -It'll exploit most sudo privileges listed in GTFOBins to pop a root shell, as well as exploiting issues like a writable `docker.sock`, or the recent dirty pipe (CVE-2022-0847). More routes to root will be added over time too. - -## Usage - -Run with no arguments to find potential vulnerabilities/misconfigurations which could allow privilege escalation. Add the `-p` flag if the current user password is known. The password will be requested if it's needed to analyse sudo permissions etc. - -```bash -traitor -p -``` - -Run with the `-a`/`--any` flag to find potential vulnerabilities, attempting to exploit each, stopping if a root shell is gained. Again, add the `-p` flag if the current user password is known. - -```bash -traitor -a -p -``` - -Run with the `-e`/`--exploit` flag to attempt to exploit a specific vulnerability and gain a root shell. - -```bash -traitor -p -e docker:writable-socket -``` - -## Supported Platforms - -Traitor will run on all Unix-like systems, though certain exploits will only function on certain systems. - -## Getting Traitor - -Grab a binary from the [releases page](https://github.com/liamg/traitor/releases), or use go: - -``` -CGO_ENABLED=0 go get -u github.com/liamg/traitor/cmd/traitor -``` - -For go1.18: - -``` -CGO_ENABLED=0 go install github.com/liamg/traitor/cmd/traitor@latest -``` - -If the machine you're attempting privesc on cannot reach GitHub to download the binary, and you have no way to upload the binary to the machine over SCP/FTP etc., then you can try base64 encoding the binary on your machine, and echoing the base64 encoded string to `| base64 -d > /tmp/traitor` on the target machine, remembering to `chmod +x` it once it arrives. - -## In The News -- 20/06/21: [Console 58](https://console.substack.com/p/console-58) - Awesome newsletter featuring tools and beta releases for developers. -- 28/04/21: [Intigriti Bug Bytes #120](https://blog.intigriti.com/2021/04/28/bug-bytes-120-macos-pwned-homebrew-rce-the-worlds-shortest-backdoor/) - Recommended tools -- 09/03/21: [Hacker News thread](https://news.ycombinator.com/item?id=26224719) +"Изменение 1 в branch2" From 2e73da0a038aedd433248df7a1e73a9a4442668a Mon Sep 17 00:00:00 2001 From: Milana Date: Wed, 19 Feb 2025 09:59:47 +0300 Subject: [PATCH 5/6] =?UTF-8?q?=D0=98=D0=B7=D0=BC=D0=B5=D0=BD=D0=B5=D0=BD?= =?UTF-8?q?=D0=B8=D0=B5=202=20=D0=B2=20README.md=20=D0=B2=20branch2?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit --- README.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/README.md b/README.md index b467a5b6..1486aa87 100644 --- a/README.md +++ b/README.md @@ -1 +1 @@ -"Изменение 1 в branch2" +"Изменение 2 в branch2" From 8cc4c0bcbafe3c59e944925298c7f359e5fe349b Mon Sep 17 00:00:00 2001 From: Milana Date: Wed, 19 Feb 2025 10:00:09 +0300 Subject: [PATCH 6/6] =?UTF-8?q?=D0=98=D0=B7=D0=BC=D0=B5=D0=BD=D0=B5=D0=BD?= =?UTF-8?q?=D0=B8=D0=B5=203=20=D0=B2=20README.md=20=D0=B2=20branch2?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit --- README.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/README.md b/README.md index 1486aa87..8662c9cf 100644 --- a/README.md +++ b/README.md @@ -1 +1 @@ -"Изменение 2 в branch2" +"Изменение 3 в branch2"