Identifier / Programs / Linux and Unix
ffmpeg
Video conversion tool. tldr-pages
GTFOBins library-load 1 documented command
How ffmpeg is abused
library-load
-f-i-afEach abuse is GTFOBins's category and the options and words it uses; the full write-up is on GTFOBins's page for ffmpeg.
1 documented command
library-load unprivileged, with sudo, as SUID
ffmpeg -f lavfi -i anullsrc -af ladspa=file=/path/to/lib.so /path/to/temp-file.wav
reset^JThe command the identifier reads trips no Sigma process-creation rule. This command is from GTFOBins, at commit acd524623f9c of 2026-05-27, under the GPL-3.0, with no warranty. Changed: Markdown is shown formatted. The source is in lolbas-gtfobins-commands.json.gz, and the full entry is on GTFOBins’s page for ffmpeg. The identifier reads the line that runs ffmpeg.
Everyday use
Extract the sound from a video and save it as MP3
ffmpeg -i path/to/video.mp4 -vn path/to/sound.mp3IdentifyTranscode a FLAC file to Red Book CD format (44100kHz, 16bit)
ffmpeg -i path/to/input_audio.flac -ar 44100 -sample_fmt s16 path/to/output_audio.wavIdentifySave a video as GIF, scaling the height to 1000px and setting framerate to 15
ffmpeg -i path/to/video.mp4 -filter:v 'scale=-1:1000' -r 15 path/to/output.gifIdentifyNone of the 3 examples the identifier reads matches GTFOBins abuse or trips a Sigma process-creation rule.