awk — Shell Escape

awk is a pattern-scanning and processing language available on virtually every UNIX system. When allowed via sudo NOPASSWD or set SUID, its system() function provides a direct shell-escape — cataloged in GTFOBins.

Shell escape via sudo

If awk can be run with passwordless sudo (check sudo -l):

sudo awk 'BEGIN {system("/bin/sh")}'

The BEGIN block executes before any input is read, so no file argument is needed. system() passes the string to the shell, yielding a root prompt.

Variants

GTFOBins also catalogs gawk, mawk, and nawk — all accept the same BEGIN {system("/bin/sh")} payload. Some builds support reverse/bind shells directly via awk socket functions (see GTFOBins for gawk/nawk).

Detection and hardening

• Sudo rules: sudo -l reveals NOPASSWD entries; text-processing utilities with system() are escape hatches.
• SUID audit: find / -perm -4000 -type f 2>/dev/null (see find-command) should never list awk or its variants.
• Process monitoring: Sigma rules exist for suspicious awk shell spawns (e.g., proc_creation_lnx_awk_shell_spawn).

Sources

• GTFOBins — awk

Related: vim-shell-escape, suid-shell-executable, unix-permissions, find-command