Identifier / Programs / Linux and Unix
cmake
Cross-platform build automation system, that generates recipes for native build systems. tldr-pages
GTFOBins file-read 2 documented commands
How cmake is abused
file-read
-EEach abuse is GTFOBins's category and the options and words it uses; the full write-up is on GTFOBins's page for cmake.
2 documented commands
file-read unprivileged, with sudo
cmake -E cat /path/to/input-fileshell unprivileged, with sudo
echo 'execute_process(COMMAND /bin/sh)' >/path/to/CMakeLists.txt
cmake /path/to/None of the 2 commands the identifier reads trips a Sigma process-creation rule. These commands are from GTFOBins, at commit acd524623f9c of 2026-05-27, under the GPL-3.0, with no warranty. Changed: Markdown is shown formatted. The source is in lolbas-gtfobins-commands.json.gz, and the full entry is on GTFOBins’s page for cmake. The identifier reads the line of each that runs cmake.
Everyday use
Generate a build recipe in the current directory with CMakeLists.txt from a project directory
cmake path/to/project_directoryIdentifyUse a generated recipe in a given directory to build artifacts
cmake --build path/to/build_directoryIdentifyInstall the build artifacts into /usr/local/ and strip debugging symbols
cmake --install path/to/build_directory --stripIdentifyNone of the 3 examples the identifier reads matches GTFOBins abuse or trips a Sigma process-creation rule.