tar

tar (tape archiver) is the standard Unix archiving tool. It bundles multiple files into a single archive (.tar), optionally compressed with gzip (.tar.gz), bzip2 (.tar.bz2), xz (.tar.xz), or zstd (.tar.zst).

Basic usage

# Create an archive
tar -cf archive.tar file1 file2 dir/
 
# Create a compressed archive
tar -czf archive.tar.gz dir/
 
# Extract an archive
tar -xf archive.tar
 
# List contents
tar -tf archive.tar
 
# Extract with verbose output
tar -xvf archive.tar.gz

Checkpoint-action abuse (GTFOBins)

GNU tar supports --checkpoint and --checkpoint-action, which run a command every N records processed. This is a well-known privilege-escalation vector when tar is available via sudo or SUID:

tar -cf /dev/null /dev/null \
    --checkpoint=1 --checkpoint-action=exec=/bin/sh

This spawns a shell as the user running tar. It works with any input/output file and any executable binary (including reverse shells). Always check sudo -l for tar entries during Linux privilege-escalation assessments.

Related: sudo (privilege escalation), gtfobins (binary abuse reference), bash-reverse-shell (payloads).

Sources

• tar(1) — Linux manual page
• GTFOBins — tar

See also

• sudo
• gtfobins
• bash-reverse-shell
• zip-bomb — malicious archives that abuse decompression rather than checkpoint actions