Identifier / Programs / Linux and Unix
run-mailcap
Execute programs via entries in the mailcap file. tldr-pages
GTFOBins inherit 2 documented commands
How run-mailcap is abused
inherit
--actionEach abuse is GTFOBins's category and the options and words it uses; the full write-up is on GTFOBins's page for run-mailcap.
2 documented commands
inherit unprivileged, with sudo
run-mailcap --action=view text/plain:/etc/hostsinherit unprivileged, with sudo
The file must exist and be not empty.
run-mailcap --action=edit text/plain:/path/to/output-fileNone of the 2 commands the identifier reads trips a Sigma process-creation rule. These commands are, with GTFOBins’ notes, from GTFOBins, at commit acd524623f9c of 2026-05-27, under the GPL-3.0, with no warranty. Changed: Markdown is shown formatted. The source is in lolbas-gtfobins-commands.json.gz, and the full entry is on GTFOBins’s page for run-mailcap. The identifier reads the line of each that runs run-mailcap.
Everyday use
Compose any existing file or new on default mailcap edit tool
run-mailcap --action=compose path/to/fileIdentifyMatches GTFOBins abuse: inherit
View any file on default mailcap explorer
run-mailcap --action=edit path/to/fileIdentifyMatches GTFOBins abuse: inherit
Print a file using the default mailcap print tool
run-mailcap --action=print path/to/fileIdentifyMatches GTFOBins abuse: inherit
Of the 3 examples the identifier reads, 3 match GTFOBins abuse or trip a Sigma process-creation rule.