Identifier / Programs / Linux and Unix
ssh-keygen
Generate SSH keys used for authentication, password-less logins, and other things. tldr-pages
GTFOBins library-load 1 documented command
How ssh-keygen is abused
library-load
-DEach abuse is GTFOBins's category and the options and words it uses; the full write-up is on GTFOBins's page for ssh-keygen.
1 documented command
library-load unprivileged, with sudo, as SUID
The shared library must contain the void C_GetFunctionList() {} function.
ssh-keygen -D /path/to/lib.soThe command the identifier reads trips no Sigma process-creation rule. This command is, with GTFOBins’ notes, from GTFOBins, at commit acd524623f9c of 2026-05-27, under the GPL-3.0, with no warranty. Changed: Markdown is shown formatted. The source is in lolbas-gtfobins-commands.json.gz, and the full entry is on GTFOBins’s page for ssh-keygen. The identifier reads the line that runs ssh-keygen.
Everyday use
Generate a key interactively
ssh-keygenIdentifyGenerate an ed25519 key with 32 key derivation function rounds and save the key to a specific file
ssh-keygen -f ~/.ssh/filename -t ed25519 -a 32IdentifyGenerate an RSA 4096-bit key with email as a comment
ssh-keygen -t rsa -b 4096 -C "comment"IdentifyNone of the 3 examples the identifier reads matches GTFOBins abuse or trips a Sigma process-creation rule.