Identifier / Programs / Linux and Unix
sort
Sort lines of text files. tldr-pages
GTFOBins file-read, file-write 2 documented commands
How sort is abused
file-read
-mfile-write
-m-oOutput to FILE instead of stdout toyboxEach abuse is GTFOBins's category and the options and words it uses; the full write-up is on GTFOBins's page for sort.
2 documented commands
file-read unprivileged, with sudo, as SUID
sort -m /path/to/input-filefile-write unprivileged, with sudo, as SUID
echo DATA | sort -m -o /path/to/output-fileNone of the 2 commands the identifier reads trips a Sigma process-creation rule. These commands are from GTFOBins, at commit acd524623f9c of 2026-05-27, under the GPL-3.0, with no warranty. Changed: Markdown is shown formatted. The source is in lolbas-gtfobins-commands.json.gz, and the full entry is on GTFOBins’s page for sort. The identifier reads the line of each that runs sort.
Everyday use
Sort a file in ascending order
sort path/to/fileIdentifySort a file in descending order
sort --reverse path/to/fileIdentifySort a file in case-insensitive way
sort --ignore-case path/to/fileIdentifyNone of the 3 examples the identifier reads matches GTFOBins abuse or trips a Sigma process-creation rule.
Options
Show every option of sort
-bIgnore leading blanks (or trailing blanks in second part of key)-CCheck whether input is sorted-cWarn if input is unsorted-dDictionary order (use alphanumeric and whitespace chars only)-fForce uppercase (case insensitive sort)-iIgnore nonprinting characters-kSort by KEY (see below)-MMonth sort (jan, feb, etc)-nNumeric order (instead of alphabetical)-o FILEOutput to FILE instead of stdout-rReverse-sSkip fallback sort (only sort with keys)-t XUse a key separator other than whitespace-uUnique lines only-xHexadecimal numerical sort-VVersion numbers (name-1.234-rc6.5b.tgz)-zZero (null) terminated lines-k2,4looks from the start of the second to the end of the fourth word.-k2.4,5starts from the fourth character of the second word, to the end