Identifier / Programs / Linux and Unix
puppet
Manage and automate the configuration of servers. Puppet uses a declarative language to define system configurations and apply them automatically. Some subcommands such as agent, apply have their own usage documentation. tldr-pages
GTFOBins file-read, file-write, shell 1 ATT&CK technique 3 documented commands
How puppet is abused
file-read
filebucket
-lfile-write
apply
-eEach abuse is GTFOBins's category and the options and words it uses; the full write-up is on GTFOBins's page for puppet.
3 documented commands
file-read unprivileged, with sudo
The read file content is corrupted by the diff output format. The actual diff command is executed.
puppet filebucket -l diff /dev/null /path/to/input-filefile-write unprivileged, with sudo
puppet apply -e 'file { "/path/to/output-file": content => "DATA" }'shell unprivileged, with sudo
puppet apply -e "exec { '/bin/sh <$(tty) >$(tty) 2>$(tty)': }"None of the 3 commands the identifier reads trips a Sigma process-creation rule. These commands are, with GTFOBins’ notes, from GTFOBins, at commit acd524623f9c of 2026-05-27, under the GPL-3.0, with no warranty. Changed: Markdown is shown formatted. The source is in lolbas-gtfobins-commands.json.gz, and the full entry is on GTFOBins’s page for puppet. The identifier reads the line of each that runs puppet.
What detects it
Everyday use
Apply a Puppet manifest file to configure the system
puppet apply path/to/file.ppIdentifySimulate applying a manifest to preview changes
puppet apply --noop path/to/file.ppIdentifyValidate the syntax of a Puppet manifest
puppet parser validate path/to/file.ppIdentifyNone of the 3 examples the identifier reads matches GTFOBins abuse or trips a Sigma process-creation rule.