Identifier / Programs / Linux and Unix
tsc
TypeScript compiler. tldr-pages
GTFOBins file-write 2 documented commands
How tsc is abused
file-write
--outFileEach abuse is GTFOBins's category and the options and words it uses; the full write-up is on GTFOBins's page for tsc.
2 documented commands
file-read unprivileged, with sudo
Content is leaked as error messages. The file extension must be one of the supported ones, e.g., .ts, .tsx, etc.
tsc /path/to/input-file.tsfile-write unprivileged, with sudo
Content is leaked as error messages and written to file. The file extension must be one of the supported ones, e.g., .ts, .tsx, etc.
tsc /path/to/input-file.ts --outFile /path/to/output-fileNone of the 2 commands the identifier reads trips a Sigma process-creation rule. These commands are, with GTFOBins’ notes, from GTFOBins, at commit acd524623f9c of 2026-05-27, under the GPL-3.0, with no warranty. Changed: Markdown is shown formatted. The source is in lolbas-gtfobins-commands.json.gz, and the full entry is on GTFOBins’s page for tsc. The identifier reads the line of each that runs tsc.
Everyday use
Initialize a TypeScript project
tsc --initIdentifyCompile a TypeScript file into a JavaScript file with the same name
tsc path/to/file.tsIdentifyCompile a TypeScript file into JavaScript using a specific target syntax (default is ES3)
tsc --target ES5 path/to/file.tsIdentifyNone of the 3 examples the identifier reads matches GTFOBins abuse or trips a Sigma process-creation rule.