Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

No one expects command execution

0x90909090.blogspot.com

Post reply on HN
Print view View original

51–60 of 88 posts

Re: No one expects command execution

#51

Post by enno »

reubenmorais wrote: post #7
orf wrote: post #2

I don't get it, it's not really unexpected if you pass the name of the executable (which just happens to be a script) via a flag... used explicitly for passing an executable to run. I mean, is it unexpected if `./my_command --execute-this-right-now=somescript.sh` executes somescript.sh?

I guess the author's point is don't ever, ever, ever mix shells and unsanitized user inputs, even if you think it can't possibly be harmful. In other words, even if it's not obvious, doing this creates a security vulnerability: tar bla bla ${user input}

This is a point that should have been made in the author's article. As it is, it presents a poorly defined problem without offering solutions (other than "be afraid").

Re: No one expects command execution

#52

Post by ajkjk »

jcape wrote: post #46

If your ~/.bashrc is a SYMLINK to a bash or sh script, bash will AUTOMATICALLY EXECUTE that script on login. If you give rsync command a source or destination with an unescaped colon, it will read an ENVIRONMENT VARIABLE to figure out a command to run to AUTOMATICALLY CONNECT TO ARBITRARY NETWORK RESOURCES. If you have keys, it will even SKIP PASSWORD ENTRY, and with default Kerberos, it will not only skip password,…

Did this article make you angry? Why do you call it a trainwreck?

Re: No one expects command execution

#54

Post by jordan0day »

brynet wrote: post #28

And yet another interesting GNU tar "feature", also noteworthy is remote tar: https://www.gnu.org/software/tar/manual/html_section/tar_46.... > "If the archive file name includes a colon (`:'), then it is assumed to be a file on another machine. If the archive file is `user@host:file', then file is used on the host host. The remote host is accessed using [rsh]." and > "If you need to use a file whose name includes a…

It's amazing how many programs that most people would consider "core unix utilities" totally eschew the (alleged) unix philosophy of "do one thing well."

Re: No one expects command execution

#55

Post by supertruth »

WalterBright wrote: post #41
supertruth wrote: post #33

Earlier quoted context omitted.

I think you're in a bubble. Lots of people have interest in the 30s given it was the golden age of Hollywood: Gone with the Wind references have entered the cultural lexicon, so have The Wizard of Oz references.

A movie from the 70s that compares with TWoO and GWTW in stature would be Star Wars, certainly not MPatHG. I find it unremarkable that people today quote SW.

Yeah but even then, you have The Three Stooges, The Marx Brothers, and Charlie Chaplin. All 30s-era comedy groups similar in notoriety to Monty Python.

Re: No one expects command execution

#56

Post by nitrogen »

jordan0day wrote: post #54
brynet wrote: post #28

And yet another interesting GNU tar "feature", also noteworthy is remote tar: https://www.gnu.org/software/tar/manual/html_section/tar_46.... > "If the archive file name includes a colon (`:'), then it is assumed to be a file on another machine. If the archive file is `user@host:file', then file is used on the host host. The remote host is accessed using [rsh]." and > "If you need to use a file whose name includes a…

It's amazing how many programs that most people would consider "core unix utilities" totally eschew the (alleged) unix philosophy of "do one thing well."

That's probably a GNU thing. GNU's Not Unix, after all.

Re: No one expects command execution

#57

Post by im3w1l »

digi_owl wrote: post #40
im3w1l wrote: post #38

Earlier quoted context omitted.

Wow... I'm starting to get really scared of the shell, and how much hidden complexity there is waiting to trap the unwary. Feels like best practice for shellscripts is to only ever use them for one-offs. And that tar and friends should never be used as "helpers" by other programs.

Welcome to life.

What you are, rudely, implying is that what I am saying is already well known. I'd argue that isn't so.

Until recently shell-scripts was the way you inited a system. I still have almost 2000 shell scripts on my machine that I didn't write myself.

People got owned during shellshock, which means they did run helper programs, in web-facing applications even.

Re: No one expects command execution

#58

Post by brynet »

nitrogen wrote: post #56
jordan0day wrote: post #54

Earlier quoted context omitted.

It's amazing how many programs that most people would consider "core unix utilities" totally eschew the (alleged) unix philosophy of "do one thing well."

That's probably a GNU thing. GNU's Not Unix, after all.

None of the BSD tar implementations support remote tar.

Re: No one expects command execution

#59

Post by __david__ »

cbd1984 wrote: post #19
juhanima wrote: post #11

This might be related to another article about OLE execution, to cast a shadow of doubt that it is not an isolated habit. Having outside stuff executed when not meaning to is always bad. I for one would be badly disappointed, if tar xvf unexpectedly run some code. Luckily, that is not the case. UNIX got battle-hardened during its college years, the cases of unexpected execution are few and far between. One of them is…

> UNIX got battle-hardened during its college years Is that when it finally gave up making shar archives? For the unitiated: A shar is a "shell archive", or a shell script which (typically) makes heavy use of 'here documents' to do what tarballs do, only they're shell scripts so you have to execute them and then they can potentially execute arbitrary code unless you read through them very closely and actually underst…

It's been a while but I thought the real reason shars existed was because they were 7 bit clean, meaning they could be traded on usenet (or ftp in ascii mode) without needing any external program like uudecode…

> …only they're shell scripts so you have to execute them and then they can potentially execute arbitrary code unless you read through them very closely and actually understand them.

> Yes, people actually made these. Yes, people actually ran these.

Running something you downloaded is how every installer works. Self extracting zips are still a thing, too. At least with shars you could read the source.

Oh yeah, even today people still do `curl http://example.com | bash` (If someone were truly evil they'd make the first download from an IP clean and inject bad code into the second. That would catch all the people who `curl | less` first and then run it again piped to bash). :-)

Post reply on HN