RAT
tmate
tmate is an open-source terminal sharing tool for Linux and Unix-like systems, built on tmux. It enables instant terminal sharing over SSH, allowing remote terminal access and collaboration. The tool creates a unique session that can be shared with others for remote access, making it a legitimate tool for system administration but also potentially useful for unauthorized remote access.
Tool overview
- Category
- RAT
- Research authors
- Michael Haag
- Created
- 2026-01-15
- Last modified
- 2026-01-15
- Privileges
- User
- Free / availability
- Open Source
- Verification required
- Open source project
- Supported platforms
- FreeBSD
Linux
macOS
Capabilities
Executables & installation paths
- Filename
- tmate
- OriginalFileName
- Not recorded
- Description
- tmate terminal sharing binary
Installation paths
/usr/bin/tmate
/usr/local/bin/tmate
tmate
tmate.sock
tmate-ready
tmate.bashrc
FORENSIC EVIDENCE
Disk artifacts
- File
- /tmp/tmate*
- Description
- tmate socket files for terminal sharing sessions
- OS
- Linux
- File
- ~/.tmate.conf
- Description
- tmate configuration file
- OS
- Linux
- File
- tmate.sock
- Description
- tmate socket file for session communication
- OS
- Linux
- File
- tmate-ready
- Description
- tmate readiness indicator file
- OS
- Linux
- File
- tmate.bashrc
- Description
- tmate bash configuration file
- OS
- Linux
FORENSIC EVIDENCE
Network artifacts
- Description
- Known remote domains
- Domains
- tmate.io
- *.tmate.io
- Ports
- 22
- 443
References
Acknowledgements
- Person
- rcKillam
- Handle
- @rcKillam