Identifier / Programs / Linux and Unix
expand
Convert tabs to spaces. tldr-pages
GTFOBins file-read 1 documented command
How expand is abused
file-read
Each abuse is GTFOBins's category and the options and words it uses; the full write-up is on GTFOBins's page for expand.
1 documented command
file-read unprivileged, with sudo, as SUID
The read file content is corrupted by replacing tabs with spaces.
expand /path/to/input-fileThe command the identifier reads trips no Sigma process-creation rule. This command is, with GTFOBins’ notes, from GTFOBins, at commit acd524623f9c of 2026-05-27, under the GPL-3.0, with no warranty. Changed: Markdown is shown formatted. The source is in lolbas-gtfobins-commands.json.gz, and the full entry is on GTFOBins’s page for expand. The identifier reads the line that runs expand.
Everyday use
Convert tabs in each file to spaces, writing to stdout
expand path/to/fileIdentifyConvert tabs to spaces, reading from stdin
expandIdentifyDo not convert tabs after non blanks
expand --initial path/to/fileIdentifyNone of the 3 examples the identifier reads matches GTFOBins abuse or trips a Sigma process-creation rule.
Options
Show every option of expand
-t TABLISTTABLIST