Identifier / Programs / Linux and Unix
ntpdate
Synchronize and set the date and time via NTP. tldr-pages
GTFOBins file-read 1 documented command
How ntpdate is abused
file-read
-a-k-dEach abuse is GTFOBins's category and the options and words it uses; the full write-up is on GTFOBins's page for ntpdate.
1 documented command
file-read unprivileged, with sudo, as SUID
The file is actually parsed and lines are leaked through error messages.
ntpdate -a x -k /path/to/input-file -d localhostThe command the identifier reads trips no Sigma process-creation rule. This command is, with GTFOBins’ notes, from GTFOBins, at commit acd524623f9c of 2026-05-27, under the GPL-3.0, with no warranty. Changed: Markdown is shown formatted. The source is in lolbas-gtfobins-commands.json.gz, and the full entry is on GTFOBins’s page for ntpdate. The identifier reads the line that runs ntpdate.
Everyday use
Synchronize and set date and time
sudo ntpdate hostIdentifyQuery the host without setting the time
ntpdate -q hostIdentifyUse an unprivileged port in case a firewall is blocking privileged ports
sudo ntpdate -u hostIdentifyNone of the 3 examples the identifier reads matches GTFOBins abuse or trips a Sigma process-creation rule.