fzf explained: GTFOBins abuse and examples

How fzf is abused

documented by GTFOBins

command

--listen

shell T1059.004 Command and Scripting Interpreter: Unix Shell

--bind

Each abuse is GTFOBins's category and the options and words it uses; the full write-up is on GTFOBins's page for fzf.

2 documented commands

from GTFOBins, each read by the identifier

command unprivileged, with sudo, as SUID

Commands can be issued via POST requests, for example:

curl http://localhost:12345 -d 'execute(/path/to/command)'

fzf --listen=12345

Identify

shell unprivileged, with sudo, as SUID

Press Enter to receive the shell.

fzf --bind 'enter:execute(/bin/sh)'

Identify

None of the 2 commands the identifier reads trips a Sigma process-creation rule. These commands are, with GTFOBins’ notes, from GTFOBins, at commit acd524623f9c of 2026-05-27, under the GPL-3.0, with no warranty. Changed: Markdown is shown formatted. The source is in lolbas-gtfobins-commands.json.gz, and the full entry is on GTFOBins’s page for fzf. The identifier reads the line of each that runs fzf.

What detects it

Sigma process creation rules

T1059.004Command and Scripting Interpreter: Unix Shell

Everyday use

from tldr-pages, CC BY 4.0

Start fzf on all files in the specified directory

find path/to/directory -type f | fzfIdentify

-typetype is (block, char, dir, file, symlink, pipe, socket) toybox

Trips 1 Sigma rule: informationalFile and Directory Discovery - Linux by Daniil Yugoslavskiy, oscd.community, CheraghiMilad

Start fzf for running processes

ps aux | fzfIdentify

Trips 1 Sigma rule: lowProcess Discovery by Ömer Günal, oscd.community, CheraaghiMilad

Select multiple files with <Shift Tab> and write to a file

find path/to/directory -type f | fzf --multi >path/to/fileIdentify