CatalogGTFOBins

GTFO · Tool

cp

10 techniquesLinuxGTFOBinsGPL-3.0

file-read

File ReadPrivilege EscalationLinux
cp /path/to/input-file /dev/stdout
Evidence
Upstream reference
Environment
Local host
Compatibility
Linux reference. macOS compatibility has not been checked for this command and execution context.
Context
sudo
Native
file-read
MITRE
T1005

file-read

File ReadPrivilege EscalationLinux
cp /path/to/input-file /dev/stdout
Evidence
Upstream reference
Environment
Local host
Compatibility
Linux reference. macOS compatibility has not been checked for this command and execution context.
Context
suid
Native
file-read
MITRE
T1005

file-read

File ReadLinux
cp /path/to/input-file /dev/stdout
Evidence
Upstream reference
Environment
Local host
Compatibility
Linux reference. macOS compatibility has not been checked for this command and execution context.
Context
unprivileged
Native
file-read
MITRE
T1005

file-write

File WritePrivilege EscalationLinux
echo DATA | cp /dev/stdin /path/to/output-file
Evidence
Upstream reference
Environment
Local host
Compatibility
Linux reference. macOS compatibility has not been checked for this command and execution context.
Context
sudo
Native
file-write
MITRE
T1565

file-write

File WritePrivilege EscalationLinux
echo DATA | cp /dev/stdin /path/to/output-file
Evidence
Upstream reference
Environment
Local host
Compatibility
Linux reference. macOS compatibility has not been checked for this command and execution context.
Context
suid
Native
file-write
MITRE
T1565

file-write

File WriteLinux
echo DATA | cp /dev/stdin /path/to/output-file
Evidence
Upstream reference
Environment
Local host
Compatibility
Linux reference. macOS compatibility has not been checked for this command and execution context.
Context
unprivileged
Native
file-write
MITRE
T1565

privilege-escalation

Privilege EscalationLinux

This can be used to copy and then read or write files from a restricted file systems or with elevated privileges. (The GNU version of `cp` has the `--parents` option that can be used to also create the directory hierarchy specified in the source path, to the destination folder.)

cp /path/to/input-file /path/to/output-file
Evidence
Upstream reference
Environment
Local host
Compatibility
Linux reference. macOS compatibility has not been checked for this command and execution context.
Context
sudo
Native
privilege-escalation
MITRE
T1548

privilege-escalation

Privilege EscalationLinux

This can be used to copy and then read or write files from a restricted file systems or with elevated privileges. (The GNU version of `cp` has the `--parents` option that can be used to also create the directory hierarchy specified in the source path, to the destination folder.)

cp /path/to/input-file /path/to/output-file
Evidence
Upstream reference
Environment
Local host
Compatibility
Linux reference. macOS compatibility has not been checked for this command and execution context.
Context
suid
Native
privilege-escalation
MITRE
T1548

privilege-escalation

Privilege EscalationLinux

This can copy SUID permissions from any SUID binary (e.g., `/path/to/input-file`) to another.

cp --attributes-only --preserve=all /path/to/input-file /path/to/output-file
Evidence
Upstream reference
Environment
Local host
Compatibility
Linux reference. macOS compatibility has not been checked for this command and execution context.
Context
sudo
Native
privilege-escalation
MITRE
T1548

privilege-escalation

Privilege EscalationLinux

This can copy SUID permissions from any SUID binary (e.g., `/path/to/input-file`) to another.

cp --attributes-only --preserve=all /path/to/input-file /path/to/output-file
Evidence
Upstream reference
Environment
Local host
Compatibility
Linux reference. macOS compatibility has not been checked for this command and execution context.
Context
suid
Native
privilege-escalation
MITRE
T1548