Ceplin Command Identifier

Identifier / Programs / Linux and Unix

facter

GTFOBins inherit 2 documented commands

How facter is abused

documented by GTFOBins

inherit

--custom-dir

Each abuse is GTFOBins's category and the options and words it uses; the full write-up is on GTFOBins's page for facter.

2 documented commands

from GTFOBins, each read by the identifier

inherit unprivileged, with sudo

The first .rb file in the /path/to/dir/ directory will be executed.

FACTERLIB=/path/to/dir/ facter

inherit unprivileged, with sudo

The first .rb file in the /path/to/dir/ directory will be executed.

facter --custom-dir=/path/to/dir/ x

None of the 2 commands the identifier reads trips a Sigma process-creation rule. These commands are, with GTFOBins’ notes, from GTFOBins, at commit acd524623f9c of 2026-05-27, under the GPL-3.0, with no warranty. Changed: Markdown is shown formatted. The source is in lolbas-gtfobins-commands.json.gz, and the full entry is on GTFOBins’s page for facter. The identifier reads the line of each that runs facter.