GTFONow is a stdlib-only Python script that automatically detects and exploits misconfigured sudo rules, suid/sgid binaries and Linux capabilities during authorized CTFs and pentests.
| Tool | Frissi0n/GTFONow — single-file Python privilege escalation tool for misconfigured Unix permissions |
| Category | Post-exploitation / local privilege escalation automation |
| Primary Use | Automating local privilege escalation on Unix hosts during authorized CTFs, lab exercises and pentest engagements by chaining sudo, suid/sgid and capability misconfigurations |
| Safe Use | Use only on systems you own or have explicit written authorization to test — CTF boxes like HackTheBox, home labs, and contracted engagements with defined scope |
| Telemetry Note | Execution of python on target, potential file modifications at --risk 2 (cron entries, SSH keys, LD_PRELOAD files), and spawned root shells are all auditable via process accounting, file integrity monitoring and EDR |
GTFONow sits in a well-established lineage of post-exploitation tooling that turns the excellent but manual knowledge base of GTFOBins into an automated workflow. Where an operator would traditionally enumerate sudo -l output, hunt for suid/sgid binaries, and then manually cross-reference each finding against gtfobins.github.io, GTFONow attempts to close that loop end-to-end within a single python gtfonow.py invocation. The README credits GTFOBins directly as the source of its payloads, which frames the tool accurately: it is an orchestration and automation layer over a curated body of known escalation techniques rather than a novel exploit engine. With 638 stars and an MIT license, it occupies the pragmatic middle ground between heavyweight post-exploitation frameworks and hand-rolled one-liners.
The scope of what the tool automates is worth reading carefully. It targets three classes of Unix misconfiguration: sudo permissions granted to binaries that support shell escapes or arbitrary command execution, suid and sgid bits set on binaries with equivalent abuse potential, and Linux file capabilities assigned with more privilege than intended. Each of these is a classic audit finding that appears constantly in both CTF environments and real-world assessments, which explains the tool's topic tags spanning ctf-tools, pentesting, post-exploitation and privilege-escalation. The design intent, stated plainly in the README, is CTF-first with real-world pentest applicability — an honest framing that matches how most operators will actually deploy it.
Beyond the three core misconfiguration classes, the README lists several primitive-conversion features that reveal the tool's more interesting engineering. GTFONow can take an arbitrary file read primitive and convert it into a shell by stealing SSH keys, and it can convert an arbitrary file write primitive into execution through three distinct routes: dropping SSH keys into an authorized location, writing cron entries, or leveraging LD_PRELOAD. These conversion chains are the part of the tool that goes beyond simple GTFOBins lookup — they encode a decision tree about how weak primitives compose into code execution, which is genuinely useful analytical material for defenders trying to understand blast radius of individually low-severity findings.
The user-facing surface is deliberately small. The basic invocation is python gtfonow.py [OPTIONS], and the README highlights a fileless variant that pipes the script directly into the interpreter over HTTP from an operator-controlled host. In an authorized engagement this matters because it minimizes on-disk footprint, but it is equally relevant to defenders: an inbound curl-to-python pattern is a well-known behavioral indicator that network monitoring and endpoint telemetry can be tuned to catch. Notably, the README does not hard-defang its example URL, but in practice any deployment would point at infrastructure the operator controls within the engagement scope.
The option set encodes sensible operational discipline. The --level flag controls enumeration depth, with 1 as a quick default scan and 2 for thorough coverage — a useful triage distinction when working a time-boxed engagement versus studying a lab box. More interesting is --risk, which gates how aggressive the resulting actions are: level 1 performs safe operations, while level 2 permits file modifications such as the cron and SSH-key techniques. The README explicitly cautions that --risk 2 is primarily for CTFs and that operators on real engagements should understand exactly what it does before enabling it. That kind of explicit guardrail in the documentation is a good sign of a tool written by someone who has run real assessments.
Two remaining flags round out the interface. --command executes a single specified command instead of dropping into an interactive shell, which the README positions as mainly a debugging aid but which also maps naturally to scripted or headless workflows where interactivity is unavailable. -v/--verbose enables detailed output, essential when the automatic wizard stalls and the operator needs to see why a candidate technique was rejected. There is also an --auto flag that bypasses the interactive user wizard entirely and attempts exploitation without prompting, trading human judgment for speed — appropriate in a disposable lab, riskier on a production host during a scoped engagement.
Compatibility is a standout engineering choice and arguably the tool's chief architectural decision. GTFONow is a backwards-compatible, stdlib-only Python script with no third-party dependencies, running under both Python2.* and Python3.*, on any Unix variant including Linux and macOS, and on any architecture such as X86, X86-64 or ARM64. This is a nontrivial constraint: it means no pip installation, no virtual environment management, and no supply-chain surface beyond the single file itself. On compromised or minimally provisioned hosts — exactly the environment where post-exploitation tooling must run — the ability to execute with whatever interpreter is already present materially improves reliability.
From a defender's perspective, GTFONow is best understood as a catalog of the audit failures that make it effective. Every technique it automates is preventable through configuration hygiene: tight sudoers policy, regular suid/sgid audits with tools like find, capability reviews via getcap, and restrictions on writable paths that feed cron and LD_PRELOAD abuse. Its telemetry footprint is correspondingly broad — spawned elevated shells, new cron entries, modified authorized_keys files, and LD_PRELOAD environment changes are all high-signal events for file integrity monitoring and EDR. The repo's CI badge indicates a docker-pytest workflow, meaning the automated techniques are regression-tested in containers, which speaks to maintenance discipline and gives defenders a concrete artifact to study technique behavior safely.
In an authorized workflow, GTFONow fits naturally as the escalation stage after initial access on an in-scope host, compressing what used to be a manual hour of cross-referencing GTFOBins into a single scripted pass. The interactive wizard default keeps a human in the loop on technique selection, which is the right posture for engagements where collateral effects matter, while --auto suits lab reproduction and CTF speedruns. Operators should still verify each proposed technique manually at --risk 2, since file modifications on shared infrastructure can persist beyond the engagement window and must be documented and reverted.
As with any automation over a public knowledge base, GTFONow is only as current as its payload set and only as correct as its detection logic for what constitutes a misconfiguration. It does not replace manual enumeration when subtlety is involved — indirect sudo grants, environment-dependent capabilities, or application-layer escalation all fall outside its stated scope. But for the bread-and-butter misconfigurations that dominate CTF boxes and appear with uncomfortable regularity in real audits, it is a well-scoped, dependency-free, sensibly gated automation tool that respects the operator's time and, through its --risk discipline, the integrity of the target system.
Frissi0n/GTFONow.Educational analysis for authorized security professionals. Use only in controlled, authorized environments.
0 comentários:
Post a Comment
Note: Only a member of this blog may post a comment.