Linux Basics for Hackers

Tarring Files Together

Usually, the first thing you do when compressing files is to combine them into an archive. In most cases, when archiving files, you’ll use the tar command. Tar stands for tape archive, a reference to the prehistoric days of computing when systems used tape to store data. The tar command creates a single file from many files, which is then referred to as an archive, tar file, or tarball.
For instance, say you had three script files like the ones we used in Chapter 8, named hackersarise1, hackersarise2, and hackersarise3. If you navigate to the directory that holds them and perform a long listing, you can clearly see the files and the details you’d expect, including the size of the files, as shown here:

kali >ls -l
-rwxr-xr-x 1 root root 22311 Nov 27 2018 13:00 hackersarise1.sh
-rwxr-xr-x 1 root root 8791 Nov 27 2018 13:00 hackersarise2.sh
-rwxr-xr-x 1 root root 3992 Nov 27 2018 13:00 hackersarise3.sh

Let’s say you want to send all three of these files to another hacker you’re working with on a project. You can combine them and create a single archive file using the command in Listing 9-1.

kali >tar -cvf HackersArise.tar hackersarise1 hackersarise2 hackersarise3
hackersarise1 hackersarise2 hackersarise3

Listing 9-1: Creating a tarball of three files
Let’s break down this command to better understand it. The archiving command is tar, and we’re using it here with three options. The c option means create, v (which stands for verbose and is optional) lists the files that tar is dealing with, and f means write to the following file. This last option will also work for reading from files. Then we give the new archive the filename you want to create from the three scripts: HackersArise.tar.
In full, this command will take all three files and create a single file, HackersArise.tar, out of them. When you do another long listing of the directory, you will see that it also contains the new .tar file, as shown next:

kali >ls -l
--snip--
-rw-r--r-- 1 root root 40960 Nov 27 2018 13:32 HackersArise.tar
--snip-- kali >

Note the size of the tarball here: 40,960 bytes. When the three files are archived, tar uses significant overhead to perform this operation: whereas the sum of the three files before archiving was 35,094 bytes, after archiving, the tarball had grown to 40,960 bytes. In other words, the archiving process has added over 5,000 bytes. Although this overhead can be significant with small files, it becomes less and less significant with larger and larger files.
We can display those files from the tarball, without extracting them, by using the tar command with the -t content list switch, as shown next:

kali >tar -tvf HackersArise.tar
-rwxr-xr-x 1 root root 22311 Nov 27 2018 13:00 hackersarise1.sh
-rwxr-xr-x 1 root root 8791 Nov 27 2018 13:00 hackersarise2.sh
-rwxr-xr-x 1 root root 3992 Nov 27 2018 13:00 hackersarise3.sh

Here, we see our three original files and their original sizes. You can then extract those files from the tarball using the tar command with the x (extract) switch, as shown next:

kali >tar -xvf HackersArise.tar
hackersarise1.sh hackersarise2.sh hackersarise3.sh

Because you’re still using the –v switch, this command will show which files are being extracted in the output. If you want to extract the files and do so “silently,” meaning without showing any output, you can simply remove the -v (verbose) switch, as shown here:

kali >tar -xf HackersArise.tar

The files have been extracted into the current directory; you can do a long listing on the directory to double-check. Note that by default, if an extracted file already exists, tar will remove the existing file and replace it with the extracted file.