Identifier / Programs / Linux and Unix
bundle
Dependency manager for the Ruby programming language. tldr-pages
GTFOBins inherit, shell 1 ATT&CK technique 5 documented commands
How bundle is abused
inherit
help
inherit
console
shell T1059.004 Command and Scripting Interpreter: Unix Shell
exec
shell T1059.004 Command and Scripting Interpreter: Unix Shell
install
Each abuse is GTFOBins's category and the options and words it uses; the full write-up is on GTFOBins's page for bundle.
5 documented commands
inherit unprivileged, with sudo
bundle helpinherit unprivileged, with sudo
touch Gemfile
bundle consoleshell unprivileged, with sudo
BUNDLE_GEMFILE=x bundle exec /bin/shshell unprivileged, with sudo
touch Gemfile
bundle exec /bin/shshell unprivileged, with sudo
This might run the shell twice, one after the other.
echo 'system("/bin/sh")' >Gemfile
bundle installNone of the 5 commands the identifier reads trips a Sigma process-creation rule. These commands are, with GTFOBins’ notes, from GTFOBins, at commit acd524623f9c of 2026-05-27, under the GPL-3.0, with no warranty. Changed: Markdown is shown formatted. The source is in lolbas-gtfobins-commands.json.gz, and the full entry is on GTFOBins’s page for bundle. The identifier reads the line of each that runs bundle.
What detects it
Everyday use
Install all gems defined in the Gemfile expected in the working directory
bundle installIdentifyMatches GTFOBins abuse: shell
Execute a command in the context of the current bundle
bundle exec command argumentsIdentifyUpdate all gems by the rules defined in the Gemfile and regenerate Gemfile.lock
bundle update --allIdentifyOf the 3 examples the identifier reads, 1 matches GTFOBins abuse or trips a Sigma process-creation rule.