fzf explained: GTFOBins abuse and examples

How fzf is abused

documented by GTFOBins

command

--listen

shell T1059.004 Command and Scripting Interpreter: Unix Shell

--bind

Each abuse is GTFOBins's category and the options and words it uses; the full write-up is on GTFOBins's page for fzf.

2 documented commands

from GTFOBins, each read by CmdID

command unprivileged, with sudo, as SUID

Commands can be issued via POST requests, for example:

curl http://localhost:12345 -d 'execute(/path/to/command)'

fzf --listen=12345

Identify

shell unprivileged, with sudo, as SUID

Press Enter to receive the shell.

fzf --bind 'enter:execute(/bin/sh)'

Identify

None of the 2 commands CmdID reads trips a Sigma process-creation rule. These commands are, with GTFOBins’ notes, from GTFOBins, at commit acd524623f9c of 2026-05-27, under the GPL-3.0, with no warranty. Changed: Markdown is shown formatted. The source is in lolbas-gtfobins-commands.json.gz, and the full entry is on GTFOBins’s page for fzf. CmdID reads the line of each that runs fzf.

What detects it

Sigma process creation rules

T1059.004Command and Scripting Interpreter: Unix Shell

Everyday use

from tldr-pages, CC BY 4.0

Start fzf on all files in the specified directory

find path/to/directory -type f | fzfIdentify

-typetype is (block, char, dir, file, symlink, pipe, socket) toybox

Trips 1 Sigma rule: informationalFile and Directory Discovery - Linux by Daniil Yugoslavskiy, oscd.community, CheraghiMilad

Start fzf for running processes

ps aux | fzfIdentify

Trips 1 Sigma rule: lowProcess Discovery by Ömer Günal, oscd.community, CheraaghiMilad

Select multiple files with <Shift Tab> and write to a file

find path/to/directory -type f | fzf --multi >path/to/fileIdentify