Linux Living-off-the-Land Binaries (GTFOBins)

Find searches directory trees for files matching criteria. When configured with SUID permissions or sudo privileges without restrictions, its -exec flag can spawn root shells or execute arbitrary commands.

Curl is a tool to transfer data from or to a server using supported protocols (HTTP, HTTPS, FTP, etc.). Attackers leverage curl to download malicious second-stage scripts and pipe directly into bash or sh for fileless in-memory execution.

The GNU Bourne Again SHell (bash) is the default interactive shell on most Linux distributions. Abused for spawning interactive reverse TCP shells, executing encoded base64 commands, and privilege escalation.

Socat is a command-line based utility that establishes two bidirectional byte streams and transfers data between them. Attackers use socat to establish encrypted TTY reverse shells and tunnel traffic across isolated network zones.

GNU Wget is a non-interactive network downloader. Attackers abuse wget to retrieve remote tools, exfiltrate data via POST requests, and execute downloaded scripts.

Python is a high-level interpreted programming language. Frequently pre-installed on Linux systems and abused by adversaries for full-fledged reverse shells, PTY spawning, local port forwarding, and script execution.

AWK is a pattern scanning and processing language. Because AWK includes built-in system() functions and file operations, SUID awk or sudo privileges can be trivially abused to break out of restricted environments and spawn shells.

GNU tar is an archiving utility. Attackers abuse tar checkpoint execution options (--checkpoint-action=exec) to spawn an interactive shell or execute arbitrary commands when running with sudo or SUID permissions.

Base64 encodes or decodes standard input or files to standard output. Attackers abuse it to read sensitive files without user permissions (when SUID) or decode obfuscated payload stages.

OpenSSL is a cryptography toolkit. Attackers leverage openssl s_client to establish encrypted TLS reverse shell sessions or exfiltrate sensitive files across monitored networks.

Vim is an interactive screen text editor. When configured with SUID permissions or privileged sudo rights without command restrictions, attackers escape into a root shell via the :! command.

Env runs a program in a modified environment. When configured with the SUID bit or unrestricted sudo access, running env to launch a shell preserves elevated root EUID permissions.

Tee reads from standard input and writes to standard output and files. Attackers abuse SUID or sudo tee to append unauthorized credentials to /etc/passwd or overwrite system configuration.

Nmap is a network exploration tool and security scanner. Attackers use custom Nmap Scripting Engine (NSE) scripts to execute arbitrary root shell commands when nmap has SUID or sudo grants.

Netcat is a versatile networking tool for TCP and UDP communication. Attackers frequently use it in conjunction with FIFOs or the -e flag to establish interactive reverse command shells.

Perl is a general-purpose programming language widely installed on Linux servers. Attackers execute socket-creation one-liners to spawn interactive reverse shells directly in memory.

Ruby is an interpreted programming language. Attackers use ruby -e one-liners to execute shell breakouts, spawn interactive PTY shells, or establish network socket connections.

GNU Debugger (gdb) allows code inspection and execution. When granted SUID permissions or privileged sudo rights, gdb can execute arbitrary shell commands prior to loading programs.

Less is an interactive terminal file pager. When invoked via sudo without secure mode, operators can escape to an interactive shell by issuing !/bin/sh from within the viewer.

More is a terminal filter for paging text. Like less, running more on terminal outputs allows executing interactive shell escapes via !/bin/sh.

Systemctl controls the systemd system and service manager. Sudo privileges on systemctl allow linking or creating transient unit files that execute root commands upon service start.

GNU cp copies files. When configured with SUID permissions, attackers can overwrite system authentication files like /etc/passwd or copy binaries with elevated attributes.

Chmod alters file mode bits. SUID or sudo chmod is abused to turn standard shells into persistent SUID root binaries by adding the 4755 permission bit.

Chown changes file owner and group. SUID chown allows users to claim ownership of root-owned scripts or binaries and subsequently modify them.

Dd converts and copies raw files and disks. Attackers abuse SUID dd to read raw partitions, memory dumps, or extract protected shadow files.

Head outputs the beginning of files. SUID head allows unauthorized users to read the initial lines of protected files like /etc/shadow or root SSH private keys.

Tail outputs the last part of files. SUID tail allows standard users to read protected credentials, tokens, and audit log entries.

Nl numbers lines from files. SUID nl enables unauthorized reading of sensitive files.

Grep searches for patterns in text files. When given SUID permissions, grep can extract passwords, hashes, and tokens from restricted files.

Sed is a stream editor for filtering and transforming text. SUID sed allows reading sensitive files or modifying configuration entries.

Xargs builds and executes command lines from standard input. SUID xargs can execute an interactive root shell retaining elevated permissions.

Date displays or sets system date and time. SUID date can be abused with the -f parameter to read files line-by-line via error messages.

Strace intercepts and records system calls. When run with SUID permissions, strace executes target binaries with preserved root privileges.

Timeout runs a command with a time limit. SUID timeout launches child programs with preserved elevated permissions.

Ionice sets or gets process I/O scheduling class and priority. SUID ionice launches child programs with elevated privileges.

Nice runs a program with modified scheduling priority. SUID nice spawns child programs retaining elevated EUID permissions.