Injection parameter in hardcoded tar command

Question

I am using the linux software solution that uses the tar command to back up huge amounts of data. A command that is hard-coded into binary that calls tar:

/bin/tar --exclude "/backup" --exclude / --ignore-failed-read -cvjf - /pbackup 2>>'/tar_err.log' | split -b 1000m - '/backup/temp/backup.tar.bz2' 

It is not possible to change the command because it is encoded. It uses bzip2 to compress data. When using the --use-compress-prog = pbzip2 parameter, I used a strong performance increase (up to 60%), which uses all the CPU cores. By simulating bzip2 from / bin / bzip 2 into the pbzip2 binary, I tried to trick the software, however, watching the process, it still uses bzip2, since I am inserting it into tar.

I know this is a tricky question, but is there a way to use pbzip2 without changing this command, which is called from the outside?

My system is Debian Sequeeze.

Thank you very much!

Answer 1

Danger: an ugly decision ahead; backup binary file before continuing

First of all, check if the hard-coded string is easy: use strings in your binary and see if it displays the string you said (it will probably consist of several parts, for example /bin/tar , --exclude , --ignore-failed-read , ...).

If this succeeds, take the hexadecimal selection editor, open the binary file and find the gated line; if it is divided into several parts, the one you need contains /bin/tar ; rewrite tar with some arbitrary three-letter name, for example. fkt ( f a k e t ar; a quick Google search did not /usr/bin/fkt results for /usr/bin/fkt , so we should be safe).

Now the program should call your /usr/bin/fkt instead of the usual tar .

Now enter /bin a script in your

 #!/bin/sh /bin/tar --use-compress-prog=pbzip2 $* 

call it with the name you selected earlier ( fkt ) and set the permissions correctly (they must be 755 and belong to root ). This script simply takes all the parameters it receives and calls the real tar , adding the parameter you need before them.

---

Another solution I suggested in the comments could be to create a chroot for the application only, rename tar to another name ( realtar , maybe?) And call the script above tar (obviously, now you have to change /bin/tar inside the script to /bin/realtar ).

If the program does not update very often, and the trick worked on the first try, I will probably go with the first solution, setting up and supporting chroots is not fun.

Answer 2

Why not move / bin / tar to (say) / bin / tar-original

Then create a script / bin / tar to do whatever you want.