ripgrep as a lolbin

This is a lesser known feature of ripgrep that can be used to spawn your own executable via proxy. All you have to do is to run ripgrep with a ‘-z/–search-zip’ flag. Once you do it, any archive file that ripgrep comes across (and supports) will be preprocessed with a decompression tool as per the below list, first:

  • *.gz – gzip -d -c
  • *.tgz – gzip -d -c
  • *.bz2 – bzip2 -d -c
  • *.tbz2 – bzip2 -d -c
  • *.xz – xz -d -c
  • *.txz – xz -d -c
  • *.lz4 – lz4 -d -c
  • *.lzma – xz –format=lzma -d -c
  • *.br – brotli -d -c
  • *.zst – zstd -q -d -c
  • *.zstd – zstd -q -d -c
  • *.Z – uncompress -c

So, you can create a dummy foo.gz file, save payload to gzip.exe and run:

rg -z "whatever" 

This will force rg.exe to launch gzip.exe.