How to Use GTFOBins: Sysadmin Security Tutorial

GTFOBins (gtfobins.github.io) is a community database of normal Unix programs, like find, vim, tar, python3 and awk, that can be abused when they run with extra privileges. Use it defensively to audit your own sudo rules, SUID binaries and capabilities before an attacker does. This guide never runs an exploit.

Related guide: Linux file permissions explained

What GTFOBins is

Each entry shows how a standard program can be misused when it is misconfigured. For example, a user allowed to run vim with sudo can read any file, and a binary with the SUID bit set may hand out a root shell. Penetration testers and attackers check it right after gaining access; you can check it first.

1. Navigate the site

Binaries are listed alphabetically with a search box and a function filter. Open a binary to see each abuse type, its prerequisites and example commands. Your goal is only to know whether that prerequisite exists on your servers.

gtfobins.github.io/gtfobins/<binary-name>/

2. Understand the function categories

A listed binary is only risky when the matching condition exists on your system.

Category	What it means
SUDO	Allowed in a sudoers rule. Audit: sudo -l
SUID	Runs as its owner (usually root). Audit: find / -perm -4000 -type f 2>/dev/null
CAPABILITIES	Has Linux capabilities like cap_setuid. Audit: getcap -r / 2>/dev/null
SHELL	Can spawn a shell. With SUDO or SUID this is the highest risk
FILE READ / WRITE	Reads or writes any file: keys, passwd, cron jobs
COMMAND	Runs any OS command, about the same as a shell
NETWORK BIND	Opens listeners or sends data out

3. Collect what is elevated on your server

Run these as each admin or service account, then look up every binary in GTFOBins. Unexpected SUID binaries and high-risk capabilities (cap_setuid, cap_dac_override, cap_net_raw) are priority findings.

sudo -l
find / -perm -4000 -type f 2>/dev/null
getcap -r / 2>/dev/null

4. Read each entry with three questions

Does the prerequisite exist on my system? If yes, is that permission intentional and needed? If not, remove it or scope it tighter.

5. Use the filter for targeted audits

New sudo rule: filter by SUDO and check the binary before granting it. New server: filter by SUID and compare with your baseline. Containers: filter by CAPABILITIES. Compliance (PCI DSS, SOC 2): FILE READ and FILE WRITE show what can bypass file permissions.

6. Act on what you find

Fix the highest risk first.

Finding	Fix
Sudo rule for a binary listed under SHELL	Remove it if not essential, or replace it with a wrapper script that allows fixed arguments only
Unexpected SUID binary	chmod u-s /path/to/binary, then find out how the bit got there
Binary with cap_setuid	setcap -r /path/to/binary and check whether the capability was needed
NOPASSWD rule with a listed binary	Highest risk: remove NOPASSWD first, then review the rule
Sudo rule with wildcard arguments	Wildcards allow argument injection: use fixed arguments

7. Verify

Run the three audit commands again and compare with your saved baseline: removed SUID bits and capabilities should be gone, and sudo -l should list only what you meant to allow.

sudo -l
find / -perm -4000 -type f 2>/dev/null | sort > suid-now.txt
diff suid-baseline.txt suid-now.txt

Make it routine

Save a baseline of SUID binaries and sudo rules when a server is built, diff it after every apt upgrade, search GTFOBins before adding any sudo rule, and put a basic SUID and sudo audit in every new admin's onboarding.

find / -perm -4000 -type f 2>/dev/null | sort > suid-baseline.txt

FAQ

Is it legal to use GTFOBins?

Yes. It is a public reference. Use it to audit systems you own or are authorized to test.

Is every binary on GTFOBins dangerous?

No. The risk only exists when the matching condition (a sudo rule, SUID bit or capability) is present on your system.

Is there a Windows equivalent?

Yes: LOLBAS (lolbas-project.github.io) documents Windows binaries that can be abused the same way.

Resources: GTFOBins · LOLBAS (Windows) · HackTricks Linux privilege escalation