Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

No one expects command execution

0x90909090.blogspot.com

Post reply on HN
Print view View original

71–80 of 88 posts

Re: No one expects command execution

#71

Post by supertruth »

WalterBright wrote: post #64
supertruth wrote: post #55

Earlier quoted context omitted.

Yeah but even then, you have The Three Stooges, The Marx Brothers, and Charlie Chaplin. All 30s-era comedy groups similar in notoriety to Monty Python.

In high school and college in the 70s, people did not go around quoting the Marx Bros. They were generally regarded as belonging to their grandparents' generation. It's just not like Python quotes today, which seem to be just as pervasive as in the 70s. Can you even think of a MB quote without looking one up? If I made a pun on one, would you recognize it?

Yeah, like I said, I think you're living in a bubble and/or this is confirmation bias. I grew up in the 00s and, from my perspective, I see Monty Python as belonging to my grandparent's generation. No one in my age group commonly quotes Monty Python.

If people still do quote Monty Python, I think it's a culty minority or people who study media. The same status as the Marx Brothers and other comedians of bygone eras.

But we can agree to disagree :)

Re: No one expects command execution

#72

Post by jjoonathan »

rylee wrote: post #70
ajkjk wrote: post #52

Earlier quoted context omitted.

Did this article make you angry? Why do you call it a trainwreck?

The article is literally "If you tell these utilities to execute this script, they'll execute this script". NONE of these should be "unexpected".

Not the point. Of course it's not surprising that these utilities will execute scripts if you tell them to. The unexpected fact is that you can tell them to -- and that this is documented behavior which probably isn't going away.

If your argument was that no programmer should be surprised that you can tell an archive utility to execute an arbitrary script, then you and the author of the post are in complete agreement. The remaining difference is that the article actually does something to fix the problem while you merely hurl an implicit insult at anyone who hasn't seen this type of privilege escalation yet. One of these actions is more constructive than the other.

Re: No one expects command execution

#73

Post by d23 »

jjoonathan wrote: post #72
rylee wrote: post #70

Earlier quoted context omitted.

The article is literally "If you tell these utilities to execute this script, they'll execute this script". NONE of these should be "unexpected".

Not the point. Of course it's not surprising that these utilities will execute scripts if you tell them to. The unexpected fact is that you can tell them to -- and that this is documented behavior which probably isn't going away. If your argument was that no programmer should be surprised that you can tell an archive utility to execute an arbitrary script, then you and the author of the post are in complete agreement…

> you merely hurl an implicit insult at anyone who hasn't seen this type of privilege escalation yet

You and I have vastly different opinions on what constitutes privilege escalation.

Re: No one expects command execution

#74

Post by bediger4000 »

tome wrote: post #17

Oh for explicity typed IO. (Sadly command-line programs have yet to pass the threshold of even having a types system at all.)

I've used a "shell" that had a type system. Just before Control Data Corporation (CDC) dried up and blew away, they put out a mainframe OS called "NOS/VE". Yes, "VE", not "BE" - "NOS/BE" was a somewhat unrelated OS for CDC mainframes.

The NOS/VE shell had string types and integer types at least. The experience was absolutely horrible. It's hard for me to remember much other than the difficulty of getting anything practical to work, and that may be a consequence of CDC's incredibly poor design choices for the "shell" rather than the types. But I personally have never said "Oh, for a type system in this darn shell!" since then.

Re: No one expects command execution

#75

Post by bediger4000 »

__david__ wrote: post #59
cbd1984 wrote: post #19

Earlier quoted context omitted.

> UNIX got battle-hardened during its college years Is that when it finally gave up making shar archives? For the unitiated: A shar is a "shell archive", or a shell script which (typically) makes heavy use of 'here documents' to do what tarballs do, only they're shell scripts so you have to execute them and then they can potentially execute arbitrary code unless you read through them very closely and actually underst…

It's been a while but I thought the real reason shars existed was because they were 7 bit clean, meaning they could be traded on usenet (or ftp in ascii mode) without needing any external program like uudecode… > …only they're shell scripts so you have to execute them and then they can potentially execute arbitrary code unless you read through them very closely and actually understand them. > Yes, people actually mad…

All you needed to undo a shar (shell archive) was a fairly common Bourne shell. We had uuencode to make things 7-bit clean. Some programs to make shar files uuencoded the archived files, but some didn't.

"shar" files existed because "tar" wasn't particularly standardized. As late as 1990, SGI Irix "tar" did bytes in reverse order from SunOS "tar". You had to convert bytes to untar a SunOS archive on Irix.

Re: No one expects command execution

#76

Post by jcape »

buu700 wrote: post #62
jcape wrote: post #46

If your ~/.bashrc is a SYMLINK to a bash or sh script, bash will AUTOMATICALLY EXECUTE that script on login. If you give rsync command a source or destination with an unescaped colon, it will read an ENVIRONMENT VARIABLE to figure out a command to run to AUTOMATICALLY CONNECT TO ARBITRARY NETWORK RESOURCES. If you have keys, it will even SKIP PASSWORD ENTRY, and with default Kerberos, it will not only skip password,…

I think the point is that this is an entire class of vulnerability that most people may never have thought about, but could very easily result in some nasty remote code execution and/or privilege escalation via setuid.

Yes, that thing that is designed to execute commands could possibly result in commands being executed. Similarly, the intended use of a setuid binary is to escalate your privileges.

I'm asking you why you thought the knife would stop cutting things when it hit your hand instead of the loaf of bread.

Re: No one expects command execution

#77

Post by ajkjk »

rylee wrote: post #70
ajkjk wrote: post #52

Earlier quoted context omitted.

Did this article make you angry? Why do you call it a trainwreck?

The article is literally "If you tell these utilities to execute this script, they'll execute this script". NONE of these should be "unexpected".

I don't disagree, but, as a relative novice with shell scripts, I definitely did not realize so many tools could execute arbitrary code.

The parent post's anger and disgust is misplaced, though. This article is informative at a novice level, and well-written to that level. Not a trainwreck.

Re: No one expects command execution

#78

Post by jcape »

wglb wrote: post #69
jcape wrote: post #46

If your ~/.bashrc is a SYMLINK to a bash or sh script, bash will AUTOMATICALLY EXECUTE that script on login. If you give rsync command a source or destination with an unescaped colon, it will read an ENVIRONMENT VARIABLE to figure out a command to run to AUTOMATICALLY CONNECT TO ARBITRARY NETWORK RESOURCES. If you have keys, it will even SKIP PASSWORD ENTRY, and with default Kerberos, it will not only skip password,…

So what is your opinion of this method of install? http://brew.sh/

I think anyone who follows that method has no idea how things work. I was actually personally offended when Ximian started handing that out as a way to install Mono a decade+ ago, because it is absolutely the worst practice you can imagine: go pull [expective] from a URL, and throw it directly from the network into system(). I will "strong no" candidates who think it's a good idea, and I reject any PRs that do [expletive] like it.

All that said, between Gmail's spam filter, my avoidance of all things bitcoin, and common sense with passwords (don't ever re-use them), most of the damage caused by this doesn't affect me.

I will note, however, that this are why "when you hit return in the URL bar, what actually happens," is a valid interview question, in the same unfortunate sense that FizzBuzz is a valid interview question.

Re: No one expects command execution

#79

Post by jcape »

ajkjk wrote: post #52
jcape wrote: post #46

If your ~/.bashrc is a SYMLINK to a bash or sh script, bash will AUTOMATICALLY EXECUTE that script on login. If you give rsync command a source or destination with an unescaped colon, it will read an ENVIRONMENT VARIABLE to figure out a command to run to AUTOMATICALLY CONNECT TO ARBITRARY NETWORK RESOURCES. If you have keys, it will even SKIP PASSWORD ENTRY, and with default Kerberos, it will not only skip password,…

Did this article make you angry? Why do you call it a trainwreck?

Because it is treating all of these intended side-effects of using a shell as though they are security vulnerabilities.

The problem is that there is a way for untrusted user input to ever touch a shell in the first place.

Seriously, I challenge you to find a language reference that doesn't decry the use of their version of system(3)---because all that does is run the given command under the user's shell.

Re: No one expects command execution

#80

Post by JadeNB »

__david__ wrote: post #59
cbd1984 wrote: post #19

Earlier quoted context omitted.

> UNIX got battle-hardened during its college years Is that when it finally gave up making shar archives? For the unitiated: A shar is a "shell archive", or a shell script which (typically) makes heavy use of 'here documents' to do what tarballs do, only they're shell scripts so you have to execute them and then they can potentially execute arbitrary code unless you read through them very closely and actually underst…

It's been a while but I thought the real reason shars existed was because they were 7 bit clean, meaning they could be traded on usenet (or ftp in ascii mode) without needing any external program like uudecode… > …only they're shell scripts so you have to execute them and then they can potentially execute arbitrary code unless you read through them very closely and actually understand them. > Yes, people actually mad…

> That would catch all the people who `curl | less` first and then run it again piped to bash

Are many people security-conscious enough to do the former but security-unconscious enough to do the latter? I would assume that one would do `curl http://example.com > evilscript; vim evilscript` and then `bash evilscript` if necessary.

Post reply on HN