Identifier / Programs / Linux and Unix
setfacl
Set file access control lists (ACL). tldr-pages
GTFOBins privilege-escalation 1 documented command
How setfacl is abused
privilege-escalation
-mEach abuse is GTFOBins's category and the options and words it uses; the full write-up is on GTFOBins's page for setfacl.
1 documented command
privilege-escalation with sudo, as SUID
This can be run with elevated privileges to change ownership and then read, write, or execute a file.
setfacl -m u:$(id -un):rwx /path/to/input-fileTrips 2 Sigma rules: lowLocal System Accounts Discovery - Linux by Alejandro Ortuno, oscd.community, CheraghiMilad; lowLocal System Accounts Discovery - MacOs by Alejandro Ortuno, oscd.community
The command the identifier reads trips a Sigma process-creation rule. This command is, with GTFOBins’ notes, from GTFOBins, at commit acd524623f9c of 2026-05-27, under the GPL-3.0, with no warranty. Changed: Markdown is shown formatted. The source is in lolbas-gtfobins-commands.json.gz, and the full entry is on GTFOBins’s page for setfacl. The identifier reads the line that runs setfacl.
Everyday use
Modify ACL of a file for user with read and write access
setfacl --modify u:username:rw path/to/file_or_directoryIdentifyModify default ACL of a file for all users
setfacl --default --modify u::rw path/to/file_or_directoryIdentifyRemove ACL of a file for a user
setfacl --remove u:username path/to/file_or_directoryIdentifyNone of the 3 examples the identifier reads matches GTFOBins abuse or trips a Sigma process-creation rule.