Identifier / Programs / Linux and Unix
chown
Change user and group ownership of files and directories. tldr-pages
GTFOBins privilege-escalation 1 documented command
How chown is abused
privilege-escalation
-gnEach abuse is GTFOBins's category and the options and words it uses; the full write-up is on GTFOBins's page for chown.
1 documented command
privilege-escalation with sudo, as SUID
This can be run with elevated privileges to change ownership and then read, write, or execute a file.
chown $(id -un):$(id -gn) /path/to/input-fileTrips 2 Sigma rules: lowLocal System Accounts Discovery - Linux by Alejandro Ortuno, oscd.community, CheraghiMilad; lowLocal System Accounts Discovery - MacOs by Alejandro Ortuno, oscd.community
The command the identifier reads trips a Sigma process-creation rule. This command is, with GTFOBins’ notes, from GTFOBins, at commit acd524623f9c of 2026-05-27, under the GPL-3.0, with no warranty. Changed: Markdown is shown formatted. The source is in lolbas-gtfobins-commands.json.gz, and the full entry is on GTFOBins’s page for chown. The identifier reads the line that runs chown.
Everyday use
Change the owner user of a file/directory
sudo chown user path/to/file_or_directoryIdentifyChange the owner user and group of a file/directory
sudo chown user:group path/to/file_or_directoryIdentifyChange the owner user and group to both have the name user
sudo chown user: path/to/file_or_directoryIdentifyNone of the 3 examples the identifier reads matches GTFOBins abuse or trips a Sigma process-creation rule.
Options
Show every option of chown
-fSuppress most error messages-hChange symlinks instead of what they point to-RRecurse into subdirectories (implies -h)-HWith -R change target of symlink, follow command line symlinks-LWith -R change target of symlink, follow all symlinks-PWith -R change symlink, do not follow symlinks (default)-vVerbose