Identifier / Programs / Linux and Unix
bee
GTFOBins inherit 1 documented command
How bee is abused
inherit
eval
Each abuse is GTFOBins's category and the options and words it uses; the full write-up is on GTFOBins's page for bee.
1 documented command
inherit unprivileged, with sudo, as SUID
This allows to run PHP code (...).
This must be excuted from the Backdrop CMS root directory (e.g. /var/www/html), alternatively use the --root option.
bee eval '...'The command the identifier reads trips no Sigma process-creation rule. This command is, with GTFOBins’ notes, from GTFOBins, at commit acd524623f9c of 2026-05-27, under the GPL-3.0, with no warranty. Changed: Markdown is shown formatted. The source is in lolbas-gtfobins-commands.json.gz, and the full entry is on GTFOBins’s page for bee. The identifier reads the line that runs bee.