Identifier / Programs / Linux and Unix

pkg

Package management utility for Termux. tldr-pages

GTFOBins command 1 documented command

How pkg is abused

documented by GTFOBins

command

install

-y

--no-repo-update

Each abuse is GTFOBins's category and the options and words it uses; the full write-up is on GTFOBins's page for pkg.

1 documented command

from GTFOBins, each read by the identifier

command with sudo

Generate the FreeBSD package with fpm and upload it to the target.

echo /path/to/command >x.sh
fpm -n x -s dir -t freebsd -a all --before-install x.sh .

pkg install -y --no-repo-update ./x-1.0.txz

Identify

The command the identifier reads trips no Sigma process-creation rule. This command is, with GTFOBins’ notes, from GTFOBins, at commit acd524623f9c of 2026-05-27, under the GPL-3.0, with no warranty. Changed: Markdown is shown formatted. The source is in lolbas-gtfobins-commands.json.gz, and the full entry is on GTFOBins’s page for pkg. The identifier reads the line that runs pkg.

Everyday use

from tldr-pages, CC BY 4.0

Upgrade all installed packages

pkg [upIdentify

List currently installed packages

pkg [list-iIdentify

Install a package

pkg [i packageIdentify

None of the 3 examples the identifier reads matches GTFOBins abuse or trips a Sigma process-creation rule.

pkg

How pkg is abused

1 documented command

Everyday use

Other programs abused for command