Identifier / Programs / Linux and Unix
man
Format and display manual pages. tldr-pages
GTFOBins file-read, inherit, shell 3 documented commands
How man is abused
file-read
inherit
shell
Each abuse is GTFOBins's category and the options and words it uses; the full write-up is on GTFOBins's page for man.
3 documented commands
file-read unprivileged, with sudo, as SUID
The file is shown somehow formatted and displayed in the default pager.
man /path/to/input-fileinherit unprivileged, with sudo, as SUID
man manshell unprivileged, with sudo, as SUID
This requires GNU troff (groff) to be installed.
man '-H/bin/sh #' manNone of the 3 commands the identifier reads trips a Sigma process-creation rule. These commands are, with GTFOBins’ notes, from GTFOBins, at commit acd524623f9c of 2026-05-27, under the GPL-3.0, with no warranty. Changed: Markdown is shown formatted. The source is in lolbas-gtfobins-commands.json.gz, and the full entry is on GTFOBins’s page for man. The identifier reads the line of each that runs man.
Everyday use
Display the man page for a command
man commandIdentifyOpen the man page for a command in a browser (=browser_name can be omitted if $BROWSER is set)
man --html=browser_name commandIdentifyDisplay the man page for a command from section 7
man 7 commandIdentifyNone of the 3 examples the identifier reads matches GTFOBins abuse or trips a Sigma process-creation rule.