# GTFOcli | GTFO Command Line Interface For Easy Binaries Search Commands

**URL:** <https://onehack.st/t/gtfocli-gtfo-command-line-interface-for-easy-binaries-search-commands/279701>\
**Category:** Tools & Scripts\
**Tags:** tools, hacking\
**Created:** [March 25, 2024, 7:07pm UTC](https://onehack.st/t/gtfocli-gtfo-command-line-interface-for-easy-binaries-search-commands/279701 "2024-03-25T19:07:00Z")\
**Posts on this page:** 1\
**Page:** 1

<div class="post-metadata">

**Author:** ![NoBody](https://onehack.st/user_avatar/onehack.st/nobody/32/163880_2.png) [@NoBody](https://onehack.st/u/NoBody)\
**Post date:** [March 25, 2024, 7:07pm UTC](https://onehack.st/t/gtfocli-gtfo-command-line-interface-for-easy-binaries-search-commands/279701/1 "2024-03-25T19:07:00Z")

</div>

# GTFOcli

`GTFOcli` it’s a Command Line Interface for easy binaries search commands that can be used to bypass local security restrictions in misconfigured systems.

## [![](https://github.com/cmd-tools/gtfocli/raw/main/docs/gtfocli.gif)](https://github.com/cmd-tools/gtfocli/blob/main/docs/gtfocli.gif)

## Table of Contents

- [Table of Contents](https://github.com/cmd-tools/gtfocli#table-of-contents)
- [Installation](https://github.com/cmd-tools/gtfocli#installation)
- [Usage](https://github.com/cmd-tools/gtfocli#usage)
  - [Search for Unix binaries](https://github.com/cmd-tools/gtfocli#search-for-unix-binaries)
  - [Search for Windows binaries](https://github.com/cmd-tools/gtfocli#search-for-windows-binaries)
  - [Search using dockerized solution](https://github.com/cmd-tools/gtfocli#search-using-dockerized-solution)
  - [CTF](https://github.com/cmd-tools/gtfocli#CTF)

- [Credits](https://github.com/cmd-tools/gtfocli#credits)
- [Contributing](https://github.com/cmd-tools/gtfocli#contributing)

## Installation

Using `go`:

go install [github.com/cmd-tools/gtfocli@latest](http://github.com/cmd-tools/gtfocli@latest)

Using `homebrew`:

brew tap cmd-tools/homebrew-tap brew install gtfocli

Using `docker`:

docker pull cmdtoolsowner/gtfocli

## Usage

### Search for unix binaries

Search for binary `tar`:

gtfocli search tar

Search for binary `tar` from `stdin`:

echo “tar” | gtfocli search

Search for binaries located into file;

cat myBinaryList.txt /bin/bash /bin/sh tar arp /bin/tail gtfocli search -f myBinaryList.txt

### Search for windows binaries

Search for binary `Winget.exe`:

gtfocli search Winget --os windows

Search for binary `Winget` from `stdin`:

echo “Winget” | gtfocli search --os windows

Search for binaries located into file:

cat windowsExecutableList.txt Winget c:\Users\Desktop\Ssh Stordiag Bash c:\Users\Runonce.exe Cmdkey c:\dir\subDir\Users\Certreq.exe gtfocli search -f windowsExecutableList.txt --os windows

Search for binary `Winget` and print output in `yaml` format (see `-h` for available formats):

gtfocli search Winget -o yaml --os windows

### Search using dockerized solution

Examples:

Search for binary `Winget` and print output in `yaml` format:

docker run -i cmdtoolsowner/gtfocli search Winget -o yaml --os windows

Search for binary `tar` and print output in `json` format:

echo ‘tar’ | docker run -i cmdtoolsowner/gtfocli search -o json

Search for binaries located into file mounted as volume in the container:

cat myBinaryList.txt /bin/bash /bin/sh tar arp /bin/tail docker run -i -v $(pwd):/tmp cmdtoolsowner/gtfocli search -f /tmp/myBinaryList.txt

## CTF

An example of common use case for `gtfocli` is together with `find`:

find / -type f ( -perm 04000 -o -perm -u=s ) -exec gtfocli search {} ; 2\>/dev/null

or

find / -type f ( -perm 04000 -o -perm -u=s ) 2\>/dev/null | gtfocli search

## Credits

Thanks to [GTFOBins](https://gtfobins.github.io/) and [LOLBAS](https://lolbas-project.github.io/), without these projects `gtfocli` would never have come to light.

## Contributing

You want to contribute to this project? Wow, thanks! So please just fork it and send a pull request.

## GitHub:

[https://github.com/cmd-tools/gtfocli](https://github.com/cmd-tools/gtfocli)