# tclsh

> Run Tcl files or shell commands from standard input.

tclsh is a shell-like utility that runs Tcl from standard input or a file. tclsh holds the "com.apple.security.cs.disable-library-validation" entitlement and is capable of loading arbitrary plug-ins, framework, and libraries without requiring signed code.

- Page: https://loobins.io/binaries/tclsh/
- Author: Brendan Chamberlain (@infosecB)
- Created: 2023-05-17
- Tactics: Execution

## Paths

- `/usr/bin/tclsh`

## Example Use Cases

### Execute malicious dynamic library (.dylib) from standard input

An attacker can execute a malicious .dylib from stdin by echoing a load command and piping to tclsh. This will bypass code signing requirements.

```bash
echo "load bad.dylib" | tclsh
```

- Tactics: Execution
- Tags: dylib

## Detections

- [Recommendations included in resource below. No formal detection content at this time.](https://medium.com/specter-ops-posts/dylib-loads-that-tickle-your-fancy-d25196addd8c)

## Resources

- [Dylib Loads that Tickle your Fancy](https://medium.com/specter-ops-posts/dylib-loads-that-tickle-your-fancy-d25196addd8c)

## Acknowledgements

- Leo Pitt (@_D00mfist)