Identifier / Programs / Linux and Unix
cmp
Compare two files byte by byte. tldr-pages
GTFOBins file-read 1 documented command
How cmp is abused
file-read
-b-lShow all differing bytes toyboxEach abuse is GTFOBins's category and the options and words it uses; the full write-up is on GTFOBins's page for cmp.
1 documented command
file-read unprivileged, with sudo, as SUID
Dump the bytes of the input file that are different from the NUL byte in a tabular format.
cmp /path/to/input-file /dev/zero -b -lThe command the identifier reads trips no Sigma process-creation rule. This command is, with GTFOBins’ notes, from GTFOBins, at commit acd524623f9c of 2026-05-27, under the GPL-3.0, with no warranty. Changed: Markdown is shown formatted. The source is in lolbas-gtfobins-commands.json.gz, and the full entry is on GTFOBins’s page for cmp. The identifier reads the line that runs cmp.
Everyday use
Output char and line number of the first difference between two files
cmp path/to/file1 path/to/file2IdentifyOutput info of the first difference: char, line number, bytes, and values
cmp --print-bytes path/to/file1 path/to/file2IdentifyOutput the byte numbers and values of every difference
cmp --verbose path/to/file1 path/to/file2IdentifyNone of the 3 examples the identifier reads matches GTFOBins abuse or trips a Sigma process-creation rule.
Options
Show every option of cmp
-lShow all differing bytes-n LENCompare at most LEN bytes-sSilent