Information Security Stack Exchange is a question and answer site for information security professionals. It only takes a minute to sign up.
Sign up to join this community
If I have a script which on some conditions just do
echo "rm -rf *"
Can it be exploited in some way?
EDIT: the goal is to write an enumeration script which will eventually suggests a command to execute to privilege escalate. So rm -rf is not the most appropriate example. A better example: imagine that the script finds "find" command in sudo -l list then the script will output
"find . -exec /bin/sh \; -quit"
As mentioned here:
You could pipe your command into a shell so it gets executed:
Or you could pass it as an argument to a shell:
Or you could use the bash built-in eval:
Even if your script contains several lines, including echo "rm -rf", it would be trivial to cat it and extract that line, and then apply the above mentioned tricks to wipe everything.
If this is all you do, then you are safe, as long as you never forget the echo.
As a suggestion, let ShellCheck run over your script, just to make sure you didn't do anything bad.
rm -rf *in a script is generally a bad idea, as the results could potentially be calamitous, if you forget one day and change the access permissions of the file for some reason and open it up to all users, then anyone could run that. – Ian May 31 '19 at 10:59