Identifier / Programs / Linux and Unix
unsquashfs
Uncompress, extract, and list files in squashfs filesystems. tldr-pages
GTFOBins privilege-escalation 1 documented command
How unsquashfs is abused
privilege-escalation
shell
Each abuse is GTFOBins's category and the options and words it uses; the full write-up is on GTFOBins's page for unsquashfs.
1 documented command
privilege-escalation with sudo, as SUID
unsquashfs shell
./squashfs-root/sh -pThe command the identifier reads trips no Sigma process-creation rule. This command is from GTFOBins, at commit acd524623f9c of 2026-05-27, under the GPL-3.0, with no warranty. Changed: Markdown is shown formatted. The source is in lolbas-gtfobins-commands.json.gz, and the full entry is on GTFOBins’s page for unsquashfs. The identifier reads the line that runs unsquashfs.
Everyday use
Extract a squashfs filesystem to squashfs-root in the current working directory
unsquashfs filesystem.squashfsIdentifyExtract a squashfs filesystem to the specified directory
unsquashfs -dest path/to/directory filesystem.squashfsIdentifyDisplay the names of files as they are extracted
unsquashfs -info filesystem.squashfsIdentifyNone of the 3 examples the identifier reads matches GTFOBins abuse or trips a Sigma process-creation rule.