Lion Cipher Lab
Escalate via a tar wildcard / --checkpoint-action argument injection, then fix it
- Penetration Testing / Red Team
- Intermediate
- ~45 min
- Free · no account required
Why it matters
One of the most common footguns in hand-rolled Linux automation is a privileged job that archives a directory with a wildcard: a root cron entry or backup script that does `cd /some/spool && tar czf backup.tgz *`. It looks harmless. It is not. The shell — not tar — expands that `*` into the list of filenames in the directory, and hands them to tar as separate arguments. tar, like almost every classic Unix tool, treats any argument that begins with a dash as an OPTION, not a filename. So if an ordinary, unprivileged user can create files in that directory, they can create files whose NAMES are…
What you'll learn
- explaining the tar-wildcard privesc: why `tar czf out *` lets anyone who can write files into the archived directory run code as whoever runs tar
- distinguishing this bug from a writable-file bug — here the TARGET is fine; the flaw is a privileged job globbing a directory an untrusted user can write to
- crafting the GTFOBins injection: files named `--checkpoint=1` and `--checkpoint-action=exec=sh payload.sh` plus the payload, dropped as a low-privileged user
- proving code ran as root (a setuid-root bash copy and a root-owned marker file) from an account with no privilege
- fixing it three ways and MEASURING each: `-- *` (end-of-options guard), `./*` (paths can't be read as options), and `find -print0 | tar --null -T -` (don't glob at all)
- the honest limit: the same root cause hits `chown *`, `chmod *` and `rsync`, and `--` fixes tar but is not a universal fix
Steps in this lab
- The one idea: the shell expands the wildcard, and tar reads dashes as options
- Start a throwaway container (no host root needed)
- Plant the misconfiguration: a low-priv user and a world-writable spool the root backup globs
- As the low-priv user, drop the crafted files
- Run the vulnerable backup as root — and prove code ran as root (the 'before')
- Fix 1: end the options with `--` before the wildcard
- Fix 2: glob with `./*` so every name is a path, not an option
- Fix 3 (the one a pro reaches for): don't glob at all — feed the list over a pipe
- The honest limits — same root cause, other tools