3

I was doing a penetration testing capture the flag training exercise and found a file called "backup". I checked the file type of "backup" and saw it was gzip compressed. I decompressed it to a file called "test". I then did "cat test" and saw that I was looking at a .bashrc file. But I didn't see anything useful in there and was stuck.

Eventually I found by watching a spoiler that the file type of the file test was a tar archive, and extracting it gave me what I needed.

What I'm confused about is why doing cat on a tar archive showed me one random file from the archive (or likely not random, but maybe the first file), and really nothing indicated that there was more in that file than I was shown (much more). What is going on here? How did cat know to stop after one file? Does it have something to do with how a tar is encoded?

I'd like to understand what's happening.

closed as unclear what you're asking by Ipor Sircer, Christopher, Kusalananda, RalfFriedl, Isaac Nov 27 '18 at 0:36

Please clarify your specific problem or add additional details to highlight exactly what you need. As it's currently written, it’s hard to tell exactly what you're asking. See the How to Ask page for help clarifying this question. If this question can be reworded to fit the rules in the help center, please edit the question.

  • 1
    What did you see exactly? What made you think that you were looking at a .bashrc file? – Gilles Nov 26 '18 at 21:53
  • 1
    did you do any experimenting to confirm your suspicions about tar archives? – jsotola Nov 26 '18 at 22:24
  • 1
    a tar file is not compressed. You will see the file with a header at the top if you cat it. The file command will identify the nature of the file. – Rui F Ribeiro Nov 26 '18 at 22:31
  • What does tar -tf test show you? I epect that cat test would give you the contents of the single file contained in the archive along with a single header line interesting to tar. – doneal24 Nov 26 '18 at 22:42
1

I will not answer directly to your answer but will give you tools to help you figure out what is happening.

Before you go further, I suggest you to make a backup copy of your current .bashrc file or (preferably) to perform the following in another directory than your $HOME location.

Comparison and experimentation

You can create a tar file (without compression) of a text file and perform a cat on it. You will see some interesting information at the first line : compare it to your backup file.

If you extract a non-tar file (e.g. .bashrc) here is what you will get:

$ tar xvf .bashrc
tar: This does not look like a tar archive
tar: Skipping to next header
tar: Exiting with failure status due to previous errors

As you said that extracting the backup worked, without warning message nor error, it seems this file is a tar archive.

file will be your friend

Before any extraction, you could use the file command. It will indicate you the type of the file:

$ file backup.tar
backup.tar: POSIX tar archive (GNU)
$ file .bashrc
.bashrc: ASCII text

TAR : Tape ARchive

This sounds obvious but tar is a file format that was (and is still) used to create one single file from several other a complete directory. This allows using magnetic tape as a recording medium to save them.

Did you RTFM ?

As always, reading the manual pages of tar and file will help.

The apropos command may also help, as it is a local search engine. As another example, here how you could use it (note the " here which group the search keywords as a single parameter):

apropos "file type"

The answer

Finally (because I am a nice guy), here is an example of the content of a tar file containing a .bashrc file:

$ cat backup.tar | head
.bashrc0000644000175000017500000000711012770726533011656 0ustar  myusermyuser# ~/.bashrc: executed by bash(1) for non-login shells.
# see /usr/share/doc/bash/examples/startup-files (in the package bash-doc)
# for examples

# If not running interactively, don't do anything
case $- in
    *i*) ;;
      *) return;;
esac

Not the answer you're looking for? Browse other questions tagged or ask your own question.