Identifier / Programs / Linux and Unix
eqn
Equation preprocessor for the groff (GNU Troff) document formatting system. tldr-pages
GTFOBins file-read 1 documented command
How eqn is abused
file-read
Each abuse is GTFOBins's category and the options and words it uses; the full write-up is on GTFOBins's page for eqn.
1 documented command
file-read unprivileged, with sudo, as SUID
The content is actually parsed and corrupted by the command.
eqn /path/to/input-fileThe command the identifier reads trips no Sigma process-creation rule. This command is, with GTFOBins’ notes, from GTFOBins, at commit acd524623f9c of 2026-05-27, under the GPL-3.0, with no warranty. Changed: Markdown is shown formatted. The source is in lolbas-gtfobins-commands.json.gz, and the full entry is on GTFOBins’s page for eqn. The identifier reads the line that runs eqn.
Everyday use
Process input with equations, saving the output for future typesetting with groff to PostScript
eqn path/to/input.eqn >path/to/output.roffIdentifyTypeset an input file with equations to PDF using the me macro package
eqn -T pdf path/to/input.eqn | groff -me -T pdf >path/to/output.pdfIdentifyNone of the 2 examples the identifier reads matches GTFOBins abuse or trips a Sigma process-creation rule.