RAT

tmate

tmate is an open-source terminal sharing tool for Linux and Unix-like systems, built on tmux. It enables instant terminal sharing over SSH, allowing remote terminal access and collaboration. The tool creates a unique session that can be shared with others for remote access, making it a legitimate tool for system administration but also potentially useful for unauthorized remote access.

Tool overview

Category
RAT
Research authors
Michael Haag
Created
2026-01-15
Last modified
2026-01-15
Privileges
User
Free / availability
Open Source
Verification required
Open source project
Supported platforms
FreeBSDLinuxmacOS

Capabilities

Remote Terminal AccessTerminal SharingSSH-based ConnectionSession Collaboration

Executables & installation paths

Filename
tmate
OriginalFileName
Not recorded
Description
tmate terminal sharing binary

Installation paths

/usr/bin/tmate
/usr/local/bin/tmate
tmate
tmate.sock
tmate-ready
tmate.bashrc

FORENSIC EVIDENCE

Disk artifacts

File
/tmp/tmate*
Description
tmate socket files for terminal sharing sessions
OS
Linux
File
~/.tmate.conf
Description
tmate configuration file
OS
Linux
File
tmate.sock
Description
tmate socket file for session communication
OS
Linux
File
tmate-ready
Description
tmate readiness indicator file
OS
Linux
File
tmate.bashrc
Description
tmate bash configuration file
OS
Linux

FORENSIC EVIDENCE

Network artifacts

Description
Known remote domains
Domains
  • tmate.io
  • *.tmate.io
Ports
  • 22
  • 443

References

Acknowledgements

Person
rcKillam
Handle
@rcKillam