Identifier / Programs / Linux and Unix

gdb

The GNU Debugger. tldr-pages

GTFOBins file-write, shell 1 ATT&CK technique 3 documented commands

How gdb is abused

documented by GTFOBins

file-write

-nx

-ex

shell T1059.004 Command and Scripting Interpreter: Unix Shell

-nx

-ex

Each abuse is GTFOBins's category and the options and words it uses; the full write-up is on GTFOBins's page for gdb.

3 documented commands

from GTFOBins, each read by the identifier

file-write unprivileged, with sudo, as SUID

gdb -nx -ex 'dump value /path/to/output-file "DATA"' -ex quit

Identify

inherit unprivileged, with sudo, as SUID

This allows to run Python code (...).

gdb -nx -ex 'python ...' -ex quit

Identify

shell unprivileged, with sudo, as SUID, with capabilities

gdb -nx -ex '!/bin/sh' -ex quit

Identify

With capabilities:

gdb -nx -ex 'python import os; os.setuid(0)' -ex '!/bin/sh' -ex quit

None of the 3 commands the identifier reads trips a Sigma process-creation rule. These commands are, with GTFOBins’ notes, from GTFOBins, at commit acd524623f9c of 2026-05-27, under the GPL-3.0, with no warranty. Changed: Markdown is shown formatted. The source is in lolbas-gtfobins-commands.json.gz, and the full entry is on GTFOBins’s page for gdb. The identifier reads the line of each that runs gdb.

What detects it

Sigma process creation rules

T1059.004Command and Scripting Interpreter: Unix Shell

Everyday use

from tldr-pages, CC BY 4.0

Debug an executable

gdb path/to/executableIdentify

Attach a process to gdb

gdb --pid process_idIdentify

Debug with a core file

gdb --core path/to/core path/to/executableIdentify

None of the 3 examples the identifier reads matches GTFOBins abuse or trips a Sigma process-creation rule.

gdb

How gdb is abused

3 documented commands

What detects it

Everyday use

Other programs abused for file-write