diff --git a/_gtfobins/rsyslogd.md b/_gtfobins/rsyslogd.md new file mode 100644 index 00000000..76e51cd4 --- /dev/null +++ b/_gtfobins/rsyslogd.md @@ -0,0 +1,12 @@ +--- +description: ryslogd can be abused for remotely triggerable persistence combining filter conditions and the shell execute action. +functions: + reverse-shell: + - description: After placing an executable or shell script on disk, you can trigger its execution via a logging facility by adding one line to the rsyslog.conf file + code: | + :msg, contains, "randomstringtomatch" ^/path/to/script.sh + bind-shell: + - description: After placing an executable or shell script on disk, you can trigger its execution via a logging facility by adding one line to the rsyslog.conf file + code: | + :msg, contains, "randomstringtomatch" ^/path/to/script.sh +---