Identifier / Programs / Linux and Unix
tac
Display and concatenate files with lines in reversed order. tldr-pages
GTFOBins file-read 1 documented command
How tac is abused
file-read
-sEach abuse is GTFOBins's category and the options and words it uses; the full write-up is on GTFOBins's page for tac.
1 documented command
file-read unprivileged, with sudo, as SUID
Make sure that RANDOM does not appear into the file to read otherwise the content of the file is corrupted by reversing the order of RANDOM-separated chunks.
tac -s 'RANDOM' /path/to/input-fileThe command the identifier reads trips no Sigma process-creation rule. This command is, with GTFOBins’ notes, from GTFOBins, at commit acd524623f9c of 2026-05-27, under the GPL-3.0, with no warranty. Changed: Markdown is shown formatted. The source is in lolbas-gtfobins-commands.json.gz, and the full entry is on GTFOBins’s page for tac. The identifier reads the line that runs tac.
Everyday use
Concatenate specific files in reversed order
tac path/to/file1 path/to/file2 ...IdentifyDisplay stdin in reversed order
cat path/to/file | tacIdentifyUse a specific separator
tac --separator separator path/to/file1 path/to/file2 ...IdentifyNone of the 3 examples the identifier reads matches GTFOBins abuse or trips a Sigma process-creation rule.