TIL: Some surprising code execution sources in bash
yossarian.net
TIL: Some surprising code execution sources in bash
1–10 of 51 posts
Re: TIL: Some surprising code execution sources in bash
#2My first insinct would be to remove the bashisms first:
https://gist.github.com/alganet/a4198158651f3b2dc43ce658052e...
Then, if we run it:
"line 3: test: a[$(cat /etc/passwd > /tmp/pwned)] + 42: integer expression expected"
Re: TIL: Some surprising code execution sources in bash
#3Yuck, I was always instinctively put off by [[, now I finally have some arguments to justify it.
IMO safe shell scripting is kind of dead. I can do it if I really have to, but too many external programs have tricky "convenience" features like interpreting flags after positional parameters, etc.
Re: TIL: Some surprising code execution sources in bash
#4My first insinct would be to remove the bashisms first: https://gist.github.com/alganet/a4198158651f3b2dc43ce658052e... Then, if we run it: "line 3: test: a[$(cat /etc/passwd > /tmp/pwned)] + 42: integer expression expected"
(Author of the post.)
Yep, this is specifically a bashism (by way of being a kshism). However, it's worth noting that the second variant (`type -v`) will work in `[` and `test`.
(It's also a still a bashism, but IME people don't realize how little of `type` is actually POSIX.)
Re: TIL: Some surprising code execution sources in bash
#5My first insinct would be to remove the bashisms first: https://gist.github.com/alganet/a4198158651f3b2dc43ce658052e... Then, if we run it: "line 3: test: a[$(cat /etc/passwd > /tmp/pwned)] + 42: integer expression expected"
(Author of the post.) Yep, this is specifically a bashism (by way of being a kshism). However, it's worth noting that the second variant (`type -v`) will work in `[` and `test`. (It's also a still a bashism, but IME people don't realize how little of `type` is actually POSIX.)
The second variant (test -v) for me doesn't error out, but also doesn't write the /tmp/pwnd file, which tells me there is no subscript eval there.
Re: TIL: Some surprising code execution sources in bash
#6I... don't understand. I thought the whole reason for using [[ and breaking posix compatibility was to prevent just this kind of vulnerability. Why would bash do this.
Re: TIL: Some surprising code execution sources in bash
#7Earlier quoted context omitted.
(Author of the post.) Yep, this is specifically a bashism (by way of being a kshism). However, it's worth noting that the second variant (`type -v`) will work in `[` and `test`. (It's also a still a bashism, but IME people don't realize how little of `type` is actually POSIX.)
The second variant (test -v) for me doesn't error out, but also doesn't write the /tmp/pwnd file, which tells me there is no subscript eval there.
Did you run it in bash, or in sh? It won't work in a strictly POSIX sh (in that context, I assume `type` will attempt to query each argument as if it were a PATH candidate, and then return nothing).
For reference, this works for me in Bash 5.2:
test -v 'x[$(cat /etc/passwd)]'Re: TIL: Some surprising code execution sources in bash
#8Earlier quoted context omitted.
(Author of the post.) Yep, this is specifically a bashism (by way of being a kshism). However, it's worth noting that the second variant (`type -v`) will work in `[` and `test`. (It's also a still a bashism, but IME people don't realize how little of `type` is actually POSIX.)
The second variant (test -v) for me doesn't error out, but also doesn't write the /tmp/pwnd file, which tells me there is no subscript eval there.
What shell and what `test` are you using?
Re: TIL: Some surprising code execution sources in bash
#9Honestly I just don't write shell scripts anymore, bash or otherwise. By the time any system I use is up, Python is available. I don't know if I've found a true need for shell in anything application level. I'll even fire up a Python shell for something simple like mass renaming files, simply because the string manipulation is so much easier.
Re: TIL: Some surprising code execution sources in bash
#10Earlier quoted context omitted.
The second variant (test -v) for me doesn't error out, but also doesn't write the /tmp/pwnd file, which tells me there is no subscript eval there.
Did you run it in bash, or in sh? It won't work in a strictly POSIX sh (in that context, I assume `type` will attempt to query each argument as if it were a PATH candidate, and then return nothing). For reference, this works for me in Bash 5.2: test -v 'x[$(cat /etc/passwd)]'
I ran it by creating a file named "guess.sh" with the function and a `guess "$@"` call to it, then passing 'a[$(cat /etc/passwd > /tmp/pwned)] + 42' as a parameter to the script. Bash 5.2.