I've read a dozen guides on Linux Privilege Escalation, and usually, they just tell you to copy-paste a specific line when you see a tar * wildcard in a cron job. I always knew that it worked, but I never fully grasped the mechanics of how the shell expands arguments before the binary even sees them until I did HTB Dump machine.
The Core Concept
In the walkthrough, I breakdown how the shell expands the * character into filenames before passing them to the command. I explain why creating files with names like --checkpoint=1 and --checkpoint-action=exec=sh tricks the tar command (or others like rsync/zip) into treating them as flags rather than files.
HTB Dump machine relies heavily on this. You likely start with a foothold and find a script (maybe a backup script running as root?) that blindly processes files using a wildcard.
-
Step-by-Step Execution:
-
Recon: Identifying the vulnerable process (likely via
pspyor checking crontabs). -
The Setup: Creating the malicious filenames in the directory that gets targeted by the wildcard.
-
The Trigger: Waiting for the cron job or script to run.
-
The Shell: Catching the root shell once the command executes your "filename" as an argument.
-
If you are studying for your OSCP or CPTS and still feel shaky on why wildcard injection works (or how to debug it when it fails), you need to read this. It turns a "magic trick" into a reliable weapon in your arsenal.
Check out the full methodology walkthrough here. It’s worth the read just for the diagrams and the breakdown of the argument parsing
A Masterclass in Linux Parameter Injection - HTB Dump Walkthrough
0 comments