Identifier / Programs / Linux and Unix
poetry
Manage Python packages and dependencies. Some subcommands such as about, check, env, etc. have their own usage documentation. tldr-pages
GTFOBins inherit 1 documented command
How poetry is abused
inherit
run
Each abuse is GTFOBins's category and the options and words it uses; the full write-up is on GTFOBins's page for poetry.
1 documented command
inherit unprivileged, with sudo
This allows to run Python code (...).
A valid pyproject.toml file must be present in the current working directory, you can create one with poetry init -n.
echo '...' >/path/to/temp-file
poetry run python /path/to/temp-fileThe command the identifier reads trips no Sigma process-creation rule. This command is, with GTFOBins’ notes, from GTFOBins, at commit acd524623f9c of 2026-05-27, under the GPL-3.0, with no warranty. Changed: Markdown is shown formatted. The source is in lolbas-gtfobins-commands.json.gz, and the full entry is on GTFOBins’s page for poetry. The identifier reads the line that runs poetry.
Everyday use
Create a new Poetry project in the directory with a specific name
poetry new project_nameIdentifyInstall and add a dependency and its sub-dependencies to the pyproject.toml file in the current directory
poetry add dependencyIdentifyInstall the project dependencies using the pyproject.toml file in the current directory
poetry installIdentifyNone of the 3 examples the identifier reads matches GTFOBins abuse or trips a Sigma process-creation rule.