Identifier / Programs / Linux and Unix
pandoc
Convert documents between various formats. tldr-pages
GTFOBins file-read, file-write, inherit 3 documented commands
How pandoc is abused
file-read
-tfile-write
-t-oinherit
-LEach abuse is GTFOBins's category and the options and words it uses; the full write-up is on GTFOBins's page for pandoc.
3 documented commands
file-read unprivileged, with sudo, as SUID
pandoc -t plain /path/to/input-filefile-write unprivileged, with sudo, as SUID
echo DATA | pandoc -t plain -o /path/to/output-fileinherit unprivileged, with sudo, as SUID
This allows to run Lua code (...).
echo '...' >/path/to/temp-file
pandoc -L /path/to/temp-file /dev/nullNone of the 3 commands the identifier reads trips a Sigma process-creation rule. These commands are, with GTFOBins’ notes, from GTFOBins, at commit acd524623f9c of 2026-05-27, under the GPL-3.0, with no warranty. Changed: Markdown is shown formatted. The source is in lolbas-gtfobins-commands.json.gz, and the full entry is on GTFOBins’s page for pandoc. The identifier reads the line of each that runs pandoc.
Everyday use
Convert a Markdown file to PDF using pdflatex (the formats are determined by file extensions)
pandoc path/to/input.md --output path/to/output.pdfIdentifyConvert the output from another command to PDF, using a specific PDF engine
command | pandoc --from input_format --pdf-engine tectonic --output path/to/output.pdfIdentifyConvert to a standalone file with the appropriate headers/footers (for LaTeX, HTML, etc.)
pandoc path/to/input.md --standalone --output path/to/output.htmlIdentifyNone of the 3 examples the identifier reads matches GTFOBins abuse or trips a Sigma process-creation rule.