Identifier / Programs / Linux and Unix
install
Copy files and set attributes. Typically used by Makefiles. tldr-pages
GTFOBins privilege-escalation 1 documented command
How install is abused
privilege-escalation
-mSet permissions to MODE toyboxEach abuse is GTFOBins's category and the options and words it uses; the full write-up is on GTFOBins's page for install.
1 documented command
privilege-escalation with sudo, as SUID
This can be run with elevated privileges to change permissions (6 denotes the SUID bits) and then read, write, or execute a file.
install -m 6777 /path/to/input-file /path/to/output-dir/The command the identifier reads trips no Sigma process-creation rule. This command is, with GTFOBins’ notes, from GTFOBins, at commit acd524623f9c of 2026-05-27, under the GPL-3.0, with no warranty. Changed: Markdown is shown formatted. The source is in lolbas-gtfobins-commands.json.gz, and the full entry is on GTFOBins’s page for install. The identifier reads the line that runs install.
Everyday use
Copy files to the destination
install path/to/source_file1 path/to/source_file2 ... path/to/destinationIdentifyCopy files to the destination, setting their ownership
install --owner user path/to/source_file1 path/to/source_file2 ... path/to/destinationIdentifyCopy files to the destination, setting their group ownership
install --group user path/to/source_file1 path/to/source_file2 ... path/to/destinationIdentifyNone of the 3 examples the identifier reads matches GTFOBins abuse or trips a Sigma process-creation rule.
Options
Show every option of install
-dAct like mkdir -p-DCreate leading directories for DEST-g GROUPMake copy belong to GROUP-m MODESet permissions to MODE-o USERMake copy belong to USER-pPreserve timestamps-sCall "strip -p"-t TARGETCopy files to TARGET dir (no DEST)-vVerbose