Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

URL is also a shell script that executes some malicious(?) code

github.com

Post reply on HN
Print view View original

61–70 of 74 posts

Re: URL is also a shell script that executes some malicious(?) code

#61

Post by lucideer »

kadoban wrote: post #60
lucideer wrote: post #56

Earlier quoted context omitted.

True. This can be tricky but generally: - the copy-replace trick is harder to do if you use native copy (keyboard or mouse menu) & avoid "Copy" icons pages provide - if it's such a long snippet that's too long to re-verify at a glance, maybe it's too long...

> the copy-replace trick is harder to do if you use native copy (keyboard or mouse menu) & avoid "Copy" icons pages provide Pretty sure that's not true. CSS allows you to choose both what's visible to the user, and also what's included in copy/paste. There's _some_ limitations on that, but it's flexible enough to have a lot of room to be extremely scary. You can also have a lot of fun with fonts, something that looks…

> Pretty sure that's not true.

> harder to do

You can do it via CSS trickery, or you can even do keyboard/mouse event detection and swap out via window.getSelection(), but both are much more involved & less reliable than via a button.

Re: URL is also a shell script that executes some malicious(?) code

#62

Post by pwinnski »

After I wrapped it in quotes to workaround zsh safety mechanisms:

  % curl 'http://example.com/;'$(gt=$(perl$IFS-E$IFS's//62/;s/62/chr/e;say');eval$IFS''cowsay$IFS''pwned$IFS$gt/dev/tty)';cowsay$IFS''pwned'
  zsh: no such file or directory: perl \t\n
  zsh: no such file or directory: eval \t\n
  
  
  ...

Re: URL is also a shell script that executes some malicious(?) code

#63

Post by kadoban »

lucideer wrote: post #61
kadoban wrote: post #60

Earlier quoted context omitted.

> the copy-replace trick is harder to do if you use native copy (keyboard or mouse menu) & avoid "Copy" icons pages provide Pretty sure that's not true. CSS allows you to choose both what's visible to the user, and also what's included in copy/paste. There's _some_ limitations on that, but it's flexible enough to have a lot of room to be extremely scary. You can also have a lot of fun with fonts, something that looks…

> Pretty sure that's not true. > harder to do You can do it via CSS trickery, or you can even do keyboard/mouse event detection and swap out via window.getSelection(), but both are much more involved & less reliable than via a button.

My point was that it's still not very hard. Certainly not hard enough that you can avoid worrying about it if you just turn JS off.

Re: URL is also a shell script that executes some malicious(?) code

#64

Post by Fnoord »

lucideer wrote: post #44
lucideer wrote: post #40

Earlier quoted context omitted.

Everyone pastes into their terminal, but you do have to be pretty naive to ever paste something blindly into your terminal (full depth of understanding of each mechanics isn't a requirement but basic understanding of high-level obvious components of the line being pasted should absolutely be). There is literally no way to secure against people being hacked if the scenario is a user blindly following instructions with…

(reply to sibling comment from unixbane which is [dead] for some reason:) > tell me the specific way you check your stuff before pasting so I can tell you how it's either broken or you're the 0.001% user and nobody else does that. I'm no 0.001% user, I'm not a shell expert and I can't catch everything but in the context of this particular post: - I know how string quoting in programming languages broadly works (no ne…

Usually its https nowadays but other than that there's methods a hostile webserver can detect whether the content is piped or not (IIRC I/O speed). It can decide to inject different commands based on whether it is piped or not. So you need to end up writing to a file with redirect or tee. Or by using a hash of the script. We do that with binaries, why not with scripts? If its complex enough, a shell script should be considered source code.

Re: URL is also a shell script that executes some malicious(?) code

#66

Post by IshKebab »

Calzifer wrote: post #13
habibur wrote: post #9

Earlier quoted context omitted.

the thing is, it gets executed when enclosed in single quote too. that's what worried me. as i had been quoting urls within single quotes in shell commands and had been feeling relatively safe -- till now. i noticed the single quote. know how it gets escaped from the quote. the point is : we that work on command line use single quote to enclose urls as parameter to curl/wget. and that's not safe if you don't char-by-…

No it is not. The single quote example is wrong because the evaluation part $(...) is unquoted. Take a closer look. The first single quote part ends after the first semicolon right before the $(

It's not wrong, it's just demonstrating that slapping single quotes around a string is not sufficient to make it safe. You need to escape the string properly. Guess how many people do that.

Re: URL is also a shell script that executes some malicious(?) code

#67

Post by IshKebab »

TekMol wrote: post #3

That is pretty bad. Shows that "right click, copy link, type wget ', paste, type ', enter" is a receipe to get pwned. Same is probably true even when you do not paste it into a terminal but into a script. Like "Ok, I'm gonna automate downloading this ..."

Not really though. How often do you paste code that's long enough to hide stuff like this from sources that you don't trust? Probably very rarely.

The real risk of this sort of thing is basically Bash injection - people who have bash scripts as part of their infrastructure that process public data. Sounds insane, yes. But there's a scary number of people who think Bash scripting is a sane thing to do.

Re: URL is also a shell script that executes some malicious(?) code

#68

Post by jwilk »

pwinnski wrote: post #62

After I wrapped it in quotes to workaround zsh safety mechanisms: % curl 'http://example.com/;'$(gt=$(perl$IFS-E$IFS's//62/;s/62/chr/e;say');eval$IFS''cowsay$IFS''pwned$IFS$gt/dev/tty)';cowsay$IFS''pwned' zsh: no such file or directory: perl \t\n zsh: no such file or directory: eval \t\n ...

https://github.com/jwilk/url.sh/issues/2

Re: URL is also a shell script that executes some malicious(?) code

#69

Post by nyuszika7h »

lucideer wrote: post #44
lucideer wrote: post #40

Earlier quoted context omitted.

Everyone pastes into their terminal, but you do have to be pretty naive to ever paste something blindly into your terminal (full depth of understanding of each mechanics isn't a requirement but basic understanding of high-level obvious components of the line being pasted should absolutely be). There is literally no way to secure against people being hacked if the scenario is a user blindly following instructions with…

(reply to sibling comment from unixbane which is [dead] for some reason:) > tell me the specific way you check your stuff before pasting so I can tell you how it's either broken or you're the 0.001% user and nobody else does that. I'm no 0.001% user, I'm not a shell expert and I can't catch everything but in the context of this particular post: - I know how string quoting in programming languages broadly works (no ne…

You can click the date of the post and then “vouch” if the post seems legitimate (I’ve done that for you now).

Re: URL is also a shell script that executes some malicious(?) code

#70

Post by yencabulator »

cabirum wrote: post #35

Somehow I thought there is something like "disable shell expansions" option or "raw strings mode" in Bash. Seems like I was wrong.

Single quote disables shell expansions. This input contains single quotes. I have yet to see a programming language with a "raw strings mode" that wouldn't end at the next suitable marker.
Post reply on HN