Identifier / Programs / Linux and Unix
genisoimage
Create ISO files from directories. Also aliased as genisoimage. tldr-pages
GTFOBins file-read 2 documented commands
How genisoimage is abused
file-read
-q-ofile-read
-sortEach abuse is GTFOBins's category and the options and words it uses; the full write-up is on GTFOBins's page for genisoimage.
2 documented commands
file-read unprivileged, with sudo, as SUID
The output is placed inside the ISO9660 file system binary format, it can be mounted or extracted with tools like 7z.
genisoimage -q -o - /path/to/input-filefile-read unprivileged, with sudo, as SUID
The file is parsed, and some of its content is disclosed by the error messages.
genisoimage -sort /path/to/input-fileNone of the 2 commands the identifier reads trips a Sigma process-creation rule. These commands are, with GTFOBins’ notes, from GTFOBins, at commit acd524623f9c of 2026-05-27, under the GPL-3.0, with no warranty. Changed: Markdown is shown formatted. The source is in lolbas-gtfobins-commands.json.gz, and the full entry is on GTFOBins’s page for genisoimage. The identifier reads the line of each that runs genisoimage.
Everyday use
Create an ISO from a directory
mkisofs -o filename.iso path/to/source_directoryIdentifySet the disc label when creating an ISO
mkisofs -o filename.iso -V "label_name" path/to/source_directoryIdentifyCreate an ISO image with files larger than 2GiB by reporting a smaller apparent size for ISO9660 filesystems
mkisofs -o filename.iso -allow-limited-size path/to/source_directoryIdentifyNone of the 3 examples the identifier reads matches GTFOBins abuse or trips a Sigma process-creation rule.