GTFO · Tool

bundle

10 techniquesLinuxGTFOBinsGPL-3.0

inherit ← less

ExecutionFile ReadFile WritePrivilege EscalationLinux

bundle help

Evidence: Upstream reference
Environment: Local host
Compatibility: Linux reference. macOS compatibility has not been checked for this command and execution context.
Context: sudo
Native: inherit, from:less
MITRE: T1059 T1005 T1565
Refs: gtfobins.github.io/gtfobins/bundle/

ExecutionFile ReadFile WriteLinux

bundle help

Evidence: Upstream reference
Environment: Local host
Compatibility: Linux reference. macOS compatibility has not been checked for this command and execution context.
Context: unprivileged
Native: inherit, from:less
MITRE: T1059 T1005 T1565
Refs: gtfobins.github.io/gtfobins/bundle/

ExecutionPrivilege EscalationLinux

touch Gemfile
bundle console

Evidence: Upstream reference
Environment: Local host
Compatibility: Linux reference. macOS compatibility has not been checked for this command and execution context.
Context: sudo
Native: inherit
MITRE: T1059
Refs: gtfobins.github.io/gtfobins/bundle/

ExecutionLinux

touch Gemfile
bundle console

Evidence: Upstream reference
Environment: Local host
Compatibility: Linux reference. macOS compatibility has not been checked for this command and execution context.
Context: unprivileged
Native: inherit
MITRE: T1059
Refs: gtfobins.github.io/gtfobins/bundle/

ExecutionPrivilege EscalationLinux

BUNDLE_GEMFILE=x bundle exec /bin/sh

Evidence: Upstream reference
Environment: Local host
Compatibility: Linux reference. macOS compatibility has not been checked for this command and execution context.
Context: sudo
Native: shell
MITRE: T1059
Refs: gtfobins.github.io/gtfobins/bundle/

ExecutionLinux

BUNDLE_GEMFILE=x bundle exec /bin/sh

Evidence: Upstream reference
Environment: Local host
Compatibility: Linux reference. macOS compatibility has not been checked for this command and execution context.
Context: unprivileged
Native: shell
MITRE: T1059
Refs: gtfobins.github.io/gtfobins/bundle/

ExecutionPrivilege EscalationLinux

touch Gemfile
bundle exec /bin/sh

Evidence: Upstream reference
Environment: Local host
Compatibility: Linux reference. macOS compatibility has not been checked for this command and execution context.
Context: sudo
Native: shell
MITRE: T1059
Refs: gtfobins.github.io/gtfobins/bundle/

ExecutionLinux

touch Gemfile
bundle exec /bin/sh

Evidence: Upstream reference
Environment: Local host
Compatibility: Linux reference. macOS compatibility has not been checked for this command and execution context.
Context: unprivileged
Native: shell
MITRE: T1059
Refs: gtfobins.github.io/gtfobins/bundle/

ExecutionPrivilege EscalationLinux

This might run the shell twice, one after the other.

echo 'system("/bin/sh")' >Gemfile
bundle install

Evidence: Upstream reference
Environment: Local host
Compatibility: Linux reference. macOS compatibility has not been checked for this command and execution context.
Context: sudo
Native: shell
MITRE: T1059
Refs: gtfobins.github.io/gtfobins/bundle/

ExecutionLinux

This might run the shell twice, one after the other.

echo 'system("/bin/sh")' >Gemfile
bundle install

Evidence: Upstream reference
Environment: Local host
Compatibility: Linux reference. macOS compatibility has not been checked for this command and execution context.
Context: unprivileged
Native: shell
MITRE: T1059
Refs: gtfobins.github.io/gtfobins/bundle/