Identifier / Programs / Linux and Unix
ar
Create, modify, and extract from Unix archives. Typically used for static libraries (.a) and Debian packages (.deb). tldr-pages
GTFOBins file-read 1 documented command
How ar is abused
file-read
Each abuse is GTFOBins's category and the options and words it uses; the full write-up is on GTFOBins's page for ar.
1 documented command
file-read unprivileged, with sudo, as SUID
ar r /path/to/output-file /path/to/input-file
ar p /path/to/output-fileThe command the identifier reads trips no Sigma process-creation rule. This command is from GTFOBins, at commit acd524623f9c of 2026-05-27, under the GPL-3.0, with no warranty. Changed: Markdown is shown formatted. The source is in lolbas-gtfobins-commands.json.gz, and the full entry is on GTFOBins’s page for ar. The identifier reads the line that runs ar.
Everyday use
Extract all members from an archive
ar x path/to/file.aIdentifyList contents in a specific archive
ar t path/to/file.arIdentifyreplace or add specific files to an archive
ar r path/to/file.deb path/to/debian-binary path/to/control.tar.gz path/to/data.tar.xz ...IdentifyNone of the 3 examples the identifier reads matches GTFOBins abuse or trips a Sigma process-creation rule.