Wildcard Abuse for PrivEsc (tar/borg)

Abuses a privileged command that uses a shell wildcard (*) by planting files whose names are interpreted as command-line options, achieving code execution.

Use this when a root/sudo command runs over a wildcard (e.g. *) in a directory you control. File names become arguments to the command.

Steps

• In the target directory, create files whose names act as options, e.g. --checkpoint=1 and a --checkpoint-action=exec=... payload that adds a sudoers entry.
• When the privileged command expands the * and processes those file names as flags, your injected action executes with the command's privileges.