Identifier / Programs / Linux and Unix
wireshark
GTFOBins file-write, inherit 2 documented commands
How wireshark is abused
file-write
inherit
Each abuse is GTFOBins's category and the options and words it uses; the full write-up is on GTFOBins's page for wireshark.
2 documented commands
file-write unprivileged, with sudo
This technique can be used to write arbitrary files, i.e., the dump of one UDP packet.
After starting Wireshark, and waiting for the capture to begin, deliver the UDP packet, e.g., with nc (see below). The capture then stops and the packet dump can be saved:
- select the only received packet;
- right-click on "Data" from the "Packet Details" pane, and select "Export Packet Bytes...";
- choose where to save the packet dump.
wireshark -c 1 -i lo -k -f 'udp port 12345' &
echo DATA | nc -u 127.127.127.127 12345inherit unprivileged, with sudo
This requires GUI interaction. Start Wireshark, then from the main menu, select "Tools" -> "Lua" -> "Evaluate". A window opens that allows to execute Lua code.
wiresharkNone of the 2 commands the identifier reads trips a Sigma process-creation rule. These commands are, with GTFOBins’ notes, from GTFOBins, at commit acd524623f9c of 2026-05-27, under the GPL-3.0, with no warranty. Changed: Markdown is shown formatted. The source is in lolbas-gtfobins-commands.json.gz, and the full entry is on GTFOBins’s page for wireshark. The identifier reads the line of each that runs wireshark.