3 ms·
plot twist: the binary was unlinked already
by raggi 6y ago
plot twist: the binary was unlinked already
- segfaultbuserr 6y agoA quick and dirty way to detect a modified executable on Linux, is to compare /proc/$pid/exe and its target. $ readlink /proc/$$/exe /bin/bash (deleted) $ sha256sum /proc/$$/exe $(readlink /proc/$$/exe) 16a94220a1cf204076640914f09cf0af59da07771819e7eb9671216643296d73 /proc/665119/exe 16a94220a1cf204076640914f09cf0af59da07771819e7eb9671216643296d73 /bin/bash sha256sum: '(deleted)': No such file or directory If the unlinked executable has been replaced by a new executable with the same content, they will have the same checksum, this could possibly happen if the package has been reinstalled, which is unlikely to occur. If the original executable is nowhere to be found on the disk, at least you can... $ cp /proc/$$/exe shell_bin_under_analysis $ strings shell_bin_under_analysis | grep version GNU bash, version %s-(%s) GNU bash, version %s (%s) License GPLv3+: GNU GPL version 3 or later <http://gnu.org/licenses/gpl.html> @(#)Bash version 5.0.16(1) release GNU $ strings shell_bin_under_analysis | grep zsh # [...] zsh-5.8-0-g77d203f # [...]
- m463 6y agozsh doesn't use "what" strings? well there goes that idea.