Identifier / Programs / Linux and Unix
tbl
Table preprocessor for the groff (GNU Troff) document formatting system. tldr-pages
GTFOBins file-read 1 documented command
How tbl is abused
file-read
Each abuse is GTFOBins's category and the options and words it uses; the full write-up is on GTFOBins's page for tbl.
1 documented command
file-read unprivileged, with sudo, as SUID
The read file content is corrupted by additional text at the beginning.
tbl /path/to/input-fileThe command the identifier reads trips no Sigma process-creation rule. This command is, with GTFOBins’ notes, from GTFOBins, at commit acd524623f9c of 2026-05-27, under the GPL-3.0, with no warranty. Changed: Markdown is shown formatted. The source is in lolbas-gtfobins-commands.json.gz, and the full entry is on GTFOBins’s page for tbl. The identifier reads the line that runs tbl.
Everyday use
Process input with tables, saving the output for future typesetting with groff to PostScript
tbl path/to/input_file >path/to/output.roffIdentifyTypeset input with tables to PDF using the me macro package
tbl -T pdf path/to/input.tbl | groff -me -T pdf >path/to/output.pdfIdentifyNone of the 2 examples the identifier reads matches GTFOBins abuse or trips a Sigma process-creation rule.