T1059.004: Unix Shell

Find searches directory trees for files matching criteria. When configured with SUID permissions or sudo privileges without restrictions, its -exec flag can spawn root shells or execute arbitrary commands.

Curl is a tool to transfer data from or to a server using supported protocols (HTTP, HTTPS, FTP, etc.). Attackers leverage curl to download malicious second-stage scripts and pipe directly into bash or sh for fileless in-memory execution.

The GNU Bourne Again SHell (bash) is the default interactive shell on most Linux distributions. Abused for spawning interactive reverse TCP shells, executing encoded base64 commands, and privilege escalation.

Socat is a command-line based utility that establishes two bidirectional byte streams and transfers data between them. Attackers use socat to establish encrypted TTY reverse shells and tunnel traffic across isolated network zones.

GNU tar is an archiving utility. Attackers abuse tar checkpoint execution options (--checkpoint-action=exec) to spawn an interactive shell or execute arbitrary commands when running with sudo or SUID permissions.

OpenSSL is a cryptography toolkit. Attackers leverage openssl s_client to establish encrypted TLS reverse shell sessions or exfiltrate sensitive files across monitored networks.

Vim is an interactive screen text editor. When configured with SUID permissions or privileged sudo rights without command restrictions, attackers escape into a root shell via the :! command.

Nmap is a network exploration tool and security scanner. Attackers use custom Nmap Scripting Engine (NSE) scripts to execute arbitrary root shell commands when nmap has SUID or sudo grants.

Netcat is a versatile networking tool for TCP and UDP communication. Attackers frequently use it in conjunction with FIFOs or the -e flag to establish interactive reverse command shells.

GNU Debugger (gdb) allows code inspection and execution. When granted SUID permissions or privileged sudo rights, gdb can execute arbitrary shell commands prior to loading programs.

Less is an interactive terminal file pager. When invoked via sudo without secure mode, operators can escape to an interactive shell by issuing !/bin/sh from within the viewer.

More is a terminal filter for paging text. Like less, running more on terminal outputs allows executing interactive shell escapes via !/bin/sh.

Xargs builds and executes command lines from standard input. SUID xargs can execute an interactive root shell retaining elevated permissions.

Strace intercepts and records system calls. When run with SUID permissions, strace executes target binaries with preserved root privileges.

Timeout runs a command with a time limit. SUID timeout launches child programs with preserved elevated permissions.

Ionice sets or gets process I/O scheduling class and priority. SUID ionice launches child programs with elevated privileges.

Nice runs a program with modified scheduling priority. SUID nice spawns child programs retaining elevated EUID permissions.

Installer runs system software installations. Attackers run installer from terminal with root privileges to deploy malicious package files silently without user prompts.