Identifier / Programs / Linux and Unix
shuf
Generate random permutations. tldr-pages
GTFOBins file-read, file-write 2 documented commands
How shuf is abused
file-read
-zInput/output lines are NUL terminated. toyboxfile-write
-eEcho mode: arguments are inputs to shuffle, not files to read. toybox-oEach abuse is GTFOBins's category and the options and words it uses; the full write-up is on GTFOBins's page for shuf.
2 documented commands
file-read unprivileged, with sudo, as SUID
The read file content is corrupted by randomizing the order of NUL terminated strings.
shuf -z /path/to/input-filefile-write unprivileged, with sudo, as SUID
The written file content is corrupted by adding a newline.
shuf -e DATA -o /path/to/output-fileNone of the 2 commands the identifier reads trips a Sigma process-creation rule. These commands are, with GTFOBins’ notes, from GTFOBins, at commit acd524623f9c of 2026-05-27, under the GPL-3.0, with no warranty. Changed: Markdown is shown formatted. The source is in lolbas-gtfobins-commands.json.gz, and the full entry is on GTFOBins’s page for shuf. The identifier reads the line of each that runs shuf.
Everyday use
Randomize the order of lines in a file and output the result
shuf path/to/fileIdentifyOnly output the first 5 entries of the result
shuf --head-count 5 path/to/fileIdentifyWrite the output to another file
shuf path/to/input_file --output path/to/output_fileIdentifyNone of the 3 examples the identifier reads matches GTFOBins abuse or trips a Sigma process-creation rule.
Options
Show every option of shuf
-zInput/output lines are NUL terminated.-n COUNTStop after COUNT many output lines.-eEcho mode: arguments are inputs to shuffle, not files to read.