GTFOBins
GTFOBins is a curated, community-maintained reference of Unix binaries that can be abused to bypass local security restrictions — escalate privileges, escape restricted shells, read or write arbitrary files, spawn reverse shells — when they are reachable through sudo, SUID, capabilities, or a constrained environment. It lives at gtfobins.github.io with the source in the GTFOBins/GTFOBins.github.io GitHub repo, and was created by Emilio Pinna (@norrist) and Andrea Cardaci (@cyrus_and).
The project’s premise: defenders harden the obvious paths (no root shell, restricted sudoers), but Unix ships hundreds of legitimate binaries with features — shell-out commands, file I/O, script execution, loadable modules — that collapse the moment they run with privilege. GTFOBins documents, per binary, exactly how.
Categories
Each binary is documented under the contexts in which it can be abused:
| Category | What it gives you |
|---|---|
| Shell | Spawn an interactive shell from the binary |
| Command | Execute an arbitrary command |
| SUID | Abuse when the binary has the SUID bit set |
| Sudo | Abuse when listed in sudoers (see sudo) |
| Capabilities | Abuse via Linux file capabilities (see linux-file-capabilities) |
| File read | Read arbitrary files as the privileged user |
| File write | Write arbitrary files as the privileged user |
| Reverse shell | Network shell back to the attacker |
| Limited SUID / library load | Edge cases (e.g. LD_PRELOAD-style loading) |
Using it on an engagement
The standard workflow after gaining a foothold on a Linux host:
- Enumerate —
sudo -lfor sudo rules (see sudo-nopasswd-recon),find / -perm -4000for SUID binaries,getcap -r /for capabilities. - Look up each finding in GTFOBins under the matching category. A
NOPASSWDentry for any listed binary is usually a direct privesc. - Run the documented primitive — shell escape, or file read (
/etc/shadow, flags) / write (plant an SSH key, overwrite a config) when a shell isn’t directly available.
Worked examples in this wiki
- tar —
--checkpoint-action=exec=/bin/sh - vim-shell-escape —
:!shfrom an editor - awk-shell-escape —
awk 'BEGIN {system("/bin/bash")}' - less / more / man / nano / iftop — the pager/viewer escape family
Windows counterpart: LOLBAS
LOLBAS (Living Off The Land Binaries, Scripts and Libraries, lolbas-project.github.io) is the same idea for Windows — documenting signed Microsoft binaries (certutil, mshta, rundll32, regsvr32, …) that attackers repurpose for download, execution, and defense-evasion. The broader cross-platform umbrella is LOLBins / “living off the land.”
Related
- sudo / sudo-nopasswd-recon — the primary enumeration context
- suid-shell-executable / linux-file-capabilities — the other abuse contexts
- ld-preload-trick — the env_keep companion technique
- tar / vim-shell-escape / awk-shell-escape — catalog members