This PoC creates a malicious .tar archive that attempts to overwrite /etc/sudoers (adding a passwordless sudo entry for user wacky) when extracted on a vulnerable system.

DISCLAIMER
This code is provided strictly for educational purposes, authorized security research, CTF challenges and red-team exercises.
Do NOT use this against any system without explicit written permission.
Misuse may violate computer fraud and abuse laws in your jurisdiction.

How It Works (High-Level)

1. Creates deep nested directories with very long names + same-name symlinks (causing path confusion/loops).
2. Builds a long symlink chain that escapes many directory levels upward using ../.
3. Points an "escape" symlink → traversal → /etc.
4. Uses a hard link (LNKTYPE) to alias a file inside the tar to the escaped path (/etc/sudoers).
5. Writes payload content to the hard-linked name → overwrites the target file on extraction.

Requirements

• Python 3.x (any modern version) to generate the exploit
• Vulnerable extractor on target:
  • GNU tar ≤ 1.34
  • bsdtar/libarchive in compatibility mode
  • Python tarfile with vulnerable filter settings
  • Backup/restore scripts without path restrictions

Generate the Malicious Tar