Linux: GCC Compiler Shell Execution

The gcc, c89, and c99 utilities contain functionality that allows them to use a wrapper program for compilation. By specifying a shell binary and the -s argument via the -wrapper flag, an attacker can force the compiler to execute the shell. This behavior is documented in GTFOBins and is often utilized by threat actors to break out of restricted shells or execute commands under the context of the compiler process.

Impact

The exploitation of this feature allows for arbitrary command execution on the host system. This may lead to privilege escalation if the compiler is executed with elevated permissions or within a restricted execution environment.

Recommendation

• Deploy the provided Sigma rule to detect suspicious use of compiler wrappers targeting shell binaries.
• Review environments where compiler utilities are present to determine if they are required for production operations; restrict access to these binaries on systems where they are not necessary.
• Baseline legitimate usage of the -wrapper flag in your build pipelines to differentiate between authorized builds and malicious command execution attempts.