Sstrhsrtj

I was doing a penetration testing capture the flag training exercise and found a file called "backup". I checked the file type of "backup" and saw it was gzip compressed. I decompressed it to a file called "test". I then did "cat test" and saw that I was looking at a .bashrc file. But I didn't see anything useful in there and was stuck.

Eventually I found by watching a spoiler that the file type of the file test was a tar archive, and extracting it gave me what I needed.

What I'm confused about is why doing cat on a tar archive showed me one random file from the archive (or likely not random, but maybe the first file), and really nothing indicated that there was more in that file than I was shown (much more). What is going on here? How did cat know to stop after one file? Does it have something to do with how a tar is encoded?

I'd like to understand what's happening.

I will not answer directly to your answer but will give you tools to help you figure out what is happening.

Before you go further, I suggest you to make a backup copy of your current .bashrc file or (preferably) to perform the following in another directory than your $HOME location.

Comparison and experimentation

You can create a tar file (without compression) of a text file and perform a cat on it. You will see some interesting information at the first line : compare it to your backup file.

If you extract a non-tar file (e.g. .bashrc) here is what you will get:

$ tar xvf .bashrc

tar: This does not look like a tar archive

tar: Skipping to next header

tar: Exiting with failure status due to previous errors

As you said that extracting the backup worked, without warning message nor error, it seems this file is a tar archive.

file will be your friend

Before any extraction, you could use the file command. It will indicate you the type of the file:

$ file backup.tar

backup.tar: POSIX tar archive (GNU)

$ file .bashrc

.bashrc: ASCII text

TAR : Tape ARchive

This sounds obvious but tar is a file format that was (and is still) used to create one single file from several other a complete directory. This allows using magnetic tape as a recording medium to save them.

Did you RTFM ?

As always, reading the manual pages of tar and file will help.

The apropos command may also help, as it is a local search engine. As another example, here how you could use it (note the " here which group the search keywords as a single parameter):

apropos "file type"

The answer

Finally (because I am a nice guy), here is an example of the content of a tar file containing a .bashrc file:

$ cat backup.tar | head

.bashrc0000644000175000017500000000711012770726533011656 0ustar  myusermyuser# ~/.bashrc: executed by bash(1) for non-login shells.

# see /usr/share/doc/bash/examples/startup-files (in the package bash-doc)

# for examples



# If not running interactively, don't do anything

case $- in

    *i*) ;;

      *) return;;

esac