CatalogGTFOBins

GTFO · Tool

code

6 techniquesLinuxGTFOBinsGPL-3.0

download

File DownloadPrivilege EscalationLinux

This requires a valid GitHub account. Run the command locally, then on the attacker box navigate to <https://github.com/login/device>, using the provided code to authorize the tunnel.

code tunnel --name xxxxxx
Evidence
Upstream reference
Environment
Local host
Compatibility
Linux reference. macOS compatibility has not been checked for this command and execution context.
Context
sudo
Native
download
MITRE
T1105

download

File DownloadLinux

This requires a valid GitHub account. Run the command locally, then on the attacker box navigate to <https://github.com/login/device>, using the provided code to authorize the tunnel.

code tunnel --name xxxxxx
Evidence
Upstream reference
Environment
Local host
Compatibility
Linux reference. macOS compatibility has not been checked for this command and execution context.
Context
unprivileged
Native
download
MITRE
T1105

reverse-shell

Reverse/Bind ShellPrivilege EscalationLinux

This requires a valid GitHub account. Run the command locally, then on the attacker box navigate to <https://github.com/login/device>, using the provided code to authorize the tunnel.

code tunnel --name xxxxxx
Evidence
Upstream reference
Environment
Local host
Compatibility
Linux reference. macOS compatibility has not been checked for this command and execution context.
Context
sudo
Native
reverse-shell

reverse-shell

Reverse/Bind ShellLinux

This requires a valid GitHub account. Run the command locally, then on the attacker box navigate to <https://github.com/login/device>, using the provided code to authorize the tunnel.

code tunnel --name xxxxxx
Evidence
Upstream reference
Environment
Local host
Compatibility
Linux reference. macOS compatibility has not been checked for this command and execution context.
Context
unprivileged
Native
reverse-shell

upload

File UploadPrivilege EscalationLinux

This requires a valid GitHub account. Run the command locally, then on the attacker box navigate to <https://github.com/login/device>, using the provided code to authorize the tunnel.

code tunnel --name xxxxxx
Evidence
Upstream reference
Environment
Local host
Compatibility
Linux reference. macOS compatibility has not been checked for this command and execution context.
Context
sudo
Native
upload
MITRE
T1041

upload

File UploadLinux

This requires a valid GitHub account. Run the command locally, then on the attacker box navigate to <https://github.com/login/device>, using the provided code to authorize the tunnel.

code tunnel --name xxxxxx
Evidence
Upstream reference
Environment
Local host
Compatibility
Linux reference. macOS compatibility has not been checked for this command and execution context.
Context
unprivileged
Native
upload
MITRE
T1041