CmdID / Programs / Linux and Unix

gdb

The GNU Debugger. tldr-pages

GTFOBins file-write, shell 1 ATT&CK technique 3 documented commands

How gdb is abused

documented by GTFOBins

file-write

-nx

-ex

shell T1059.004 Command and Scripting Interpreter: Unix Shell

-nx

-ex

Each abuse is GTFOBins's category and the options and words it uses; the full write-up is on GTFOBins's page for gdb.

3 documented commands

from GTFOBins, each read by CmdID

file-write unprivileged, with sudo, as SUID

gdb -nx -ex 'dump value /path/to/output-file "DATA"' -ex quit

Identify

inherit unprivileged, with sudo, as SUID

This allows to run Python code (...).

gdb -nx -ex 'python ...' -ex quit

Identify

shell unprivileged, with sudo, as SUID, with capabilities

gdb -nx -ex '!/bin/sh' -ex quit

Identify

With capabilities:

gdb -nx -ex 'python import os; os.setuid(0)' -ex '!/bin/sh' -ex quit

None of the 3 commands CmdID reads trips a Sigma process-creation rule. These commands are, with GTFOBins’ notes, from GTFOBins, at commit acd524623f9c of 2026-05-27, under the GPL-3.0, with no warranty. Changed: Markdown is shown formatted. The source is in lolbas-gtfobins-commands.json.gz, and the full entry is on GTFOBins’s page for gdb. CmdID reads the line of each that runs gdb.

What detects it

Sigma process creation rules

T1059.004Command and Scripting Interpreter: Unix Shell

Everyday use

from tldr-pages, CC BY 4.0

Debug an executable

gdb path/to/executableIdentify

Attach a process to gdb

gdb --pid process_idIdentify

Debug with a core file

gdb --core path/to/core path/to/executableIdentify

None of the 3 examples CmdID reads matches GTFOBins abuse or trips a Sigma process-creation rule.

gdb

How gdb is abused

3 documented commands

What detects it

Everyday use

Other programs abused for file-write