Ceplin Command Identifier

Identifier / Programs / Linux and Unix

ghci

The Glasgow Haskell Compiler's interactive environment. tldr-pages

GTFOBins shell 1 documented command

Opens the identifier with your command. It is read in your browser and sent nowhere.

How ghci is abused

documented by GTFOBins

shell

Each abuse is GTFOBins's category and the options and words it uses; the full write-up is on GTFOBins's page for ghci.

1 documented command

from GTFOBins, each read by the identifier

shell unprivileged, with sudo

ghci
System.Process.callCommand "/bin/sh"
Identify

The command the identifier reads trips no Sigma process-creation rule. This command is from GTFOBins, at commit acd524623f9c of 2026-05-27, under the GPL-3.0, with no warranty. Changed: Markdown is shown formatted. The source is in lolbas-gtfobins-commands.json.gz, and the full entry is on GTFOBins’s page for ghci. The identifier reads the line that runs ghci.

Everyday use

from tldr-pages, CC BY 4.0

Start a REPL (interactive shell)

Start a REPL and load the specified Haskell source file

ghci source_file.hsIdentify

Start a REPL and enable a language option

ghci -Xlanguage_optionIdentify

None of the 3 examples the identifier reads matches GTFOBins abuse or trips a Sigma process-creation rule.

Other programs abused for shell

aa-exec · agetty · ansible-playbook · ansible-test · aoss · apt · apt-get · arch-nspawn · asterisk · at · autoconf · autoheader · autoreconf · awk · borg · bpftrace