Identifier / Programs / Linux and Unix
irb
Interactive Ruby shell. tldr-pages
GTFOBins inherit 1 documented command
How irb is abused
inherit
Each abuse is GTFOBins's category and the options and words it uses; the full write-up is on GTFOBins's page for irb.
1 documented command
The command the identifier reads trips no Sigma process-creation rule. This command is, with GTFOBins’ notes, from GTFOBins, at commit acd524623f9c of 2026-05-27, under the GPL-3.0, with no warranty. Changed: Markdown is shown formatted. The source is in lolbas-gtfobins-commands.json.gz, and the full entry is on GTFOBins’s page for irb. The identifier reads the line that runs irb.
Everyday use
Start the interactive shell
irbIdentifyStart the interactive shell with the simple prompt
irb --simple-promptIdentifyStart the interactive shell without reading the configuration file
irb -fIdentifyNone of the 3 examples the identifier reads matches GTFOBins abuse or trips a Sigma process-creation rule.