Sometimes you accidentally "cat" a binary... only for your terminal to become utterly corrupted, ending up in another code page where all characters are unrecognizable, while your shell spits back at you "Command not found" "Command not found" as if you tried to execute something.

So, how can this be used in exploits?

And how can it be prevented?

And how did it end up for this to be possible in the first place?

It seems obvious that what's happening behind the scenes is that your terminal think that it is prompted for its identity, and then responds at the wrong time. But what if you had a "sleeper" shell script by that name, that re-opened a back-door or pinged someone that a careless user was at the terminal of whatever device?

  • 1
    Care to elaborate what you mean? If you use cat on a binary, it just prints the binary data, it doesn't execute anything.
    – AdHominem
    Mar 25, 2016 at 10:13
  • Not always, but often they do. I've been accidentally catting the wrong files for decades and I still often see it... always thinking that maybe one day I'll jump into the code that makes it possible, but I never get around to it... if I ever do I'll come post my own answer here...
    – Dagelf
    Mar 25, 2016 at 13:42
  • Specifically, read security.stackexchange.com/a/56391/67304 and the other answers.
    – Phil Lello
    Mar 25, 2016 at 16:36


Browse other questions tagged .