wireshark

File write

This executable can write data to local files.

Comment
This technique can be used to write arbitrary files, i.e., the dump of one UDP packet.
After starting Wireshark, and waiting for the capture to begin, deliver the UDP packet, e.g., with nc (see below). The capture then stops and the packet dump can be saved:
1. select the only received packet;
2. right-click on “Data” from the “Packet Details” pane, and select “Export Packet Bytes…”;
3. choose where to save the packet dump.
Unprivileged
This function can be performed by any unprivileged user.
```
wireshark -c 1 -i lo -k -f 'udp port 12345' &
echo DATA | nc -u 127.127.127.127 12345
```
Sudo
This function is performed by the privileged user if executed via sudo because the acquired privileges are not dropped.
RemarksIf there are environment variables involved, they must be passed via sudo VAR=value ... or exported then sudo -E ....
```
wireshark -c 1 -i lo -k -f 'udp port 12345' &
echo DATA | nc -u 127.127.127.127 12345
```

Inherit

This executable can inherit functions from another.

CommentThis requires GUI interaction. Start Wireshark, then from the main menu, select “Tools” -> “Lua” -> “Evaluate”. A window opens that allows to execute Lua code.
Unprivileged
This function can be performed by any unprivileged user.
```
wireshark
```
Sudo
This function is performed by the privileged user if executed via sudo because the acquired privileges are not dropped.
RemarksIf there are environment variables involved, they must be passed via sudo VAR=value ... or exported then sudo -E ....
```
wireshark
```
Functions
Inherits from lua, thus possibly granting its functions.