{"id":10433,"date":"2026-10-25T01:11:26","date_gmt":"2026-10-25T01:11:26","guid":{"rendered":"https:\/\/www.hexacorn.com\/blog\/?p=10433"},"modified":"2026-10-25T01:14:26","modified_gmt":"2026-10-25T01:14:26","slug":"ripgrep-as-a-lolbin","status":"publish","type":"post","link":"https:\/\/www.hexacorn.com\/blog\/2026\/10\/25\/ripgrep-as-a-lolbin\/","title":{"rendered":"ripgrep as a lolbin"},"content":{"rendered":"\n<p>This is a lesser known feature of ripgrep that can be used to spawn your own executable via proxy. All you have to do is to run ripgrep with a &#8216;-z\/&#8211;search-zip&#8217; flag. Once you do it, any archive file that ripgrep comes across (and supports) will be preprocessed with a decompression tool as per the below <a href=\"https:\/\/github.com\/BurntSushi\/ripgrep\/blob\/6892bc2b7efe5909cbbeec8f757ed2c4c76b1d30\/crates\/cli\/src\/decompress.rs#L490\">list<\/a>, first:<\/p>\n\n\n\n<ul>\n<li>*.gz &#8211; gzip -d -c<\/li>\n\n\n\n<li>*.tgz &#8211; gzip -d -c<\/li>\n\n\n\n<li>*.bz2 &#8211; bzip2 -d -c<\/li>\n\n\n\n<li>*.tbz2 &#8211; bzip2 -d -c<\/li>\n\n\n\n<li>*.xz &#8211; xz -d -c<\/li>\n\n\n\n<li>*.txz &#8211; xz -d -c<\/li>\n\n\n\n<li>*.lz4 &#8211; lz4 -d -c<\/li>\n\n\n\n<li>*.lzma &#8211; xz &#8211;format=lzma -d -c<\/li>\n\n\n\n<li>*.br &#8211; brotli -d -c<\/li>\n\n\n\n<li>*.zst &#8211; zstd -q -d -c<\/li>\n\n\n\n<li>*.zstd &#8211; zstd -q -d -c<\/li>\n\n\n\n<li>*.Z &#8211; uncompress -c<\/li>\n<\/ul>\n\n\n\n<p>So, you can create a dummy <em>foo.gz<\/em> file, save payload to <em>gzip.exe<\/em> and run:<\/p>\n\n\n\n<pre class=\"wp-block-preformatted\">rg -z \"whatever\" <\/pre>\n\n\n\n<p>This will force <em>rg.exe<\/em> to launch <em>gzip.exe<\/em>.<\/p>\n","protected":false},"excerpt":{"rendered":"<p>This is a lesser known feature of ripgrep that can be used to spawn your own executable via proxy. All you have to do is to run ripgrep with a &#8216;-z\/&#8211;search-zip&#8217; flag. Once you do it, any archive file that &hellip; <a href=\"https:\/\/www.hexacorn.com\/blog\/2026\/10\/25\/ripgrep-as-a-lolbin\/\">Continue reading <span class=\"meta-nav\">&rarr;<\/span><\/a><\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":[],"categories":[56,64],"tags":[],"_links":{"self":[{"href":"https:\/\/www.hexacorn.com\/blog\/wp-json\/wp\/v2\/posts\/10433"}],"collection":[{"href":"https:\/\/www.hexacorn.com\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.hexacorn.com\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.hexacorn.com\/blog\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/www.hexacorn.com\/blog\/wp-json\/wp\/v2\/comments?post=10433"}],"version-history":[{"count":3,"href":"https:\/\/www.hexacorn.com\/blog\/wp-json\/wp\/v2\/posts\/10433\/revisions"}],"predecessor-version":[{"id":10436,"href":"https:\/\/www.hexacorn.com\/blog\/wp-json\/wp\/v2\/posts\/10433\/revisions\/10436"}],"wp:attachment":[{"href":"https:\/\/www.hexacorn.com\/blog\/wp-json\/wp\/v2\/media?parent=10433"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.hexacorn.com\/blog\/wp-json\/wp\/v2\/categories?post=10433"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.hexacorn.com\/blog\/wp-json\/wp\/v2\/tags?post=10433"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}