DΛΣMӨП

Catalog GTFOBins

GTFO · Tool

ltrace

7 techniques LinuxGTFOBins GPL-3.0

file-read

File ReadPrivilege Escalation Linux

The file is parsed as a configuration file and its content is shown as error messages.

ltrace -F /path/to/input-file /dev/null
Context
sudo
Native
file-read
MITRE
T1005

file-read

File ReadPrivilege Escalation Linux

The file is parsed as a configuration file and its content is shown as error messages.

ltrace -F /path/to/input-file /dev/null
Context
suid
Native
file-read
MITRE
T1005

file-read

File Read Linux

The file is parsed as a configuration file and its content is shown as error messages.

ltrace -F /path/to/input-file /dev/null
Context
unprivileged
Native
file-read
MITRE
T1005

file-write

File WritePrivilege Escalation Linux

The data to be written appears amid the library function call log, quoted and with special characters escaped in octal notation. The string representation will be truncated, pick a value big enough instead of `999`. More generally, any binary that executes whatever library function call passing arbitrary data can be used in place of `ltrace -F DATA`.

ltrace -s 999 -o /path/to/input-file ltrace -F DATA
Context
sudo
Native
file-write
MITRE
T1565

file-write

File Write Linux

The data to be written appears amid the library function call log, quoted and with special characters escaped in octal notation. The string representation will be truncated, pick a value big enough instead of `999`. More generally, any binary that executes whatever library function call passing arbitrary data can be used in place of `ltrace -F DATA`.

ltrace -s 999 -o /path/to/input-file ltrace -F DATA
Context
unprivileged
Native
file-write
MITRE
T1565