14 ms·
Killbutmakeitlooklikeanaccident.sh
- sph 4y agoWhat's at 0x050f? Looks like they set the rip register to that value.
- tux3 4y agoThat's the syscall instruction (0f 05). It's not jumping to that address, it's injecting the exit syscall right under the instruction pointer. If you wanted to modify the register, you'd do `set $rip = 0x050f` without the `{short}`
- pxeger1 4y agoSo would this not work if the program's code is mapped read-only?
- saagarjha 4y agoDebuggers typically bypass normal memory permissions.
- josephcsible 4y ago"typically" being important. Here's an example of where they can't: https://gist.github.com/josephcsible/c8ce72a6084634fe56928c4bd20e6d52 https://gist.github.com/josephcsible/c8ce72a6084634fe56928c4...
- saagarjha 4y agoI'm kind of confuses as to what this is doing. I see that it just unmaps everything but the loop but what does this have to do with strace?
- josephcsible 4y agoThere's only one page of executable memory left in the whole process. It doesn't contain any syscall instructions, and it's a shared mapping of a read-only file. That means the debugger can't point the instruction pointer at any existing syscall instructions, and it also can't create any new ones.
- saagarjha 4y agoRight, but why would the debugger need to do this?
- josephcsible 4y agoBecause on Linux, those are the only ways to make another process execute a syscall. (Note that the technique I'm using wouldn't work on Windows, since there, you could use VirtualAllocEx to allocate new pages in other processes.)
- deleted 4y ago[deleted]
- josephcsible 4y agoThey're not changing the rip register at all. They're setting the contents of the memory location pointed to by the rip register to 0x050f. The equivalent of "set {x}y = z" in C would be "*(x *)y = z;".
- Sebb767 4y agoWouldn't this technically be a suicide? The process calls exit itself, after all.
- EUROCARE 4y agoThe kind of suicide where you fall on a knife, several times...
- WJW 4y agoNono, it calls `exit(0)` only once. :) (I love the cell block tango)
- RedShift1 4y agoInvoluntary euthanasia
- iso1631 4y agoIt had it coming
- formerkrogemp 4y agoAccidental discharge of gun is a frequent cause of death in the wild, wild united states of guns. Why not also falling out of window, tripping in kitchen with knife, or eating poorly cooked meat, comrade?
- 4y ago
- norom 4y agoepstein.sh
- vntok 4y agoHas anybody claimed that his death, by hanging, was an accident?
- Vogtinator 4y agoWouldn't just "p exit(0)" do the same, just with gdb doing the heavy lifting?
- Hello71 4y agonot if the program is statically linked and stripped.
- Vogtinator 4y agoI'm sure there's a way to do syscalls like that from gdb as well
- gyon 4y agoWhat is the purpose of this?
- junon 4y agoFun!
- gyon 4y ago
- flatiron 4y agoIt’s a one liner to have gdb put “exit” as the next line in a program so it closes itself. Not a security bug or anything. Just fun.
- iasay 4y agoA way to annoy developers. This and cron + sleep + rand could be fun.
- derivagral 4y agoI've had some different friends work with colleagues who literally do this. My friends typically left for various reasons, but it never seemed like the best way to "make you improve your code" to me.
- bigiain 4y agoYou are evil. Wanna get a beer sometime?
- sva_ 4y agoI think it would be better to cause an exception or even a segfault for that
- staticassertion 4y agoIn theory you could maybe use this to kill some endpoint agent used for security monitoring in a way that, if someone were to go investigate the crash, maybe they wouldn't immediately think "oh shit, someone killed it". Attackers do kill those agents, absolutely, but you'd have to be root to kill the agent with this method (and ideally any method), at which point endpoint instrumentation and forensic artifacts are unreliable anyway. Any logs that someone were looking at that said "attacker killed me" could just be deleted/ rewritten. The attacker could even rewrite them on the fly and ship them off the box so you're none the wiser :)
- gigatexal 4y ago
- z3c0 4y agoMay not be as portable, but "exit(1)" would probably make it seem more like an accident.
- jgtrosh 4y agoThat would make it look like suicide and not an accident
- SnowHill9902 4y agoSuicided.
- dylan604 4y agoYeah, but was the suicide done to it?
- moffkalast 4y agoTwo shots to the back of the head.
- ta988 4y agoTwo shots to the back of the thread
- moffkalast 4y agoHA, yes that's the real joke right there.
- yellowapple 4y agoAnd it managed to throw() itself out of the window.
- mrits 4y agoUsing gdb is like when you forget to take the silencer off your gun and claim self defense when the police comes.
- sgjohnson 4y agoI mean, if you’re at your own home, and your guns have suppressors on them… it’s fine.
- mwint 4y agoNope, they’re an NFA item. Highly regulated, you can get men in suits at your door for the offense of buying several oil filters at once.
- egberts1 4y agoNot finding any regulation on the misuse of oil filters … yet.
- mwint 4y agoThey make pretty decent silencers when affixed to the muzzle of a gun, and suddenly become an NFA item. I know a guy with a diesel repair shop who bought a “suspicious” number of filters off Amazon at once. A couple suits showed up at his door asking about them. We totally live in a surveillance state, and Amazon feeds your purchase history into it.
- prepend 4y agoIt’s weird that GitHub makes me log in to view gists. I would prefer to view them anonymously.
- thaumasiotes 4y ago> It’s weird that GitHub makes me log in to view gists. It doesn't.
- mkj 4y agoIt does for me too. (Also surprised that I'm logged out, guess it does that after a 2 week break)
- tehbeard 4y agoJust tried in chrome and Firefox both in and out of incognito mode. Worked without any login. On a VPN perhaps?
- thaumasiotes 4y ago> On a VPN perhaps? My first guess would be that the people complaining see the prompt to log in, assume it's blocking the content, and don't notice that the content appears above the prompt.
- dmd 4y agoIt doesn't. Which you can prove to yourself in incognito mode, or even just using curl.
- btdmaster 4y agohttps://web.archive.org/web/20220206233623/https://gist.github.com/moyix/95ca9a7a26a639b2322c36c7411dc3be https://web.archive.org/web/20220206233623/https://gist.gith...
- djbusby 4y agoI'm able to view with out authentication.
- Gaelan 4y agoPerhaps even more evil: kill -SEGV $1
- iasay 4y agoI see this like a cartoon black hole painted on the ground.
- revskill 4y agoSo we can use this to kill hanging process ? Or must wait till it's not hanging to kill it ?
- josephcsible 4y agoIf it's hanging in userspace, then this will work, but so will a regular "kill -9". If it's in uninterruptible sleep, then neither this nor a regular "kill -9" will work.
- justaj 4y agoIs there any reason this should have #!/bin/bash as the shebang instead of #!/bin/sh ? Especially considering it has the extension of .sh instead of .bash
- mynameisvlad 4y agoI don't think I've ever seen a script use a.bash extension, so I wouldn't put any weight on that.
- vbezhenar 4y agoIf I'm using bashisms, I'll use .bash extension. It's rare indeed, but that's because I'm trying to stay in pure sh way.
- jasonhansel 4y agoUsually you don't put any extension on scripts that use a shebang (#!), so that you can chmod +x them, put them in your path, and use them like normal commands (which don't have a suffix). IMHO the .sh extension should only be used for code that you're supposed to "source" instead of executing.
- mynameisvlad 4y agoDownloaded scripts do generally have extensions, and they are almost exclusively .eh, which was the point of my comment.
- flatiron 4y agoOnly if they are Canadian scripts.
- justaj 4y agoI only use .sh extensions for Bourne shell scripts and .bash for Bash scripts. It doesn't really matter in terms of executing scripts, but it's a handy visual indication.
- js2 4y agoThis is using exit_group() (#231), not exit() (#60): http://main.lv/notes/syscalls.md http://main.lv/notes/syscalls.md https://man7.org/linux/man-pages/man2/exit_group.2.html https://man7.org/linux/man-pages/man2/exit_group.2.html > Note: glibc provides no wrapper for exit_group(), necessitating the use of syscall(2). Hmm, but elsewhere I find: > In glibc up to version 2.3, the _exit() wrapper function invoked the kernel system call of the same name. Since glibc 2.3, the wrapper function invokes exit_group(2), in order to terminate all of the threads in a process. https://www.man7.org/linux/man-pages/man2/_exit.2.html https://www.man7.org/linux/man-pages/man2/_exit.2.html
- moyix 4y agoHaha, I don't know how folks found this, but I actually did make it for a real-world use case. While doing large-scale builds of debian packages [1], occasionally I'd have parts of the build process hang (usually some test that I didn't care about). I didn't want the whole build to fail, so I needed some way to kill the process but have it return 0 so that make and friends wouldn't think anything was amiss. Also, credit where credit is due -- the original idea was suggested to me by Kyle Huey: https://twitter.com/moyix/status/1484342467205816325 https://twitter.com/moyix/status/1484342467205816325 [1] https://moyix.blogspot.com/2022/02/on-building-30k-debian-packages.html https://moyix.blogspot.com/2022/02/on-building-30k-debian-pa...
- app4soft 4y ago> Haha, I don't know how folks found this I found it yesterday on Ukrainian Linux users forum[0], and decided to re-post it on HN ;) [0] https://linux.org.ua/index.php?topic=11868 https://linux.org.ua/index.php?topic=11868
- tomas789 4y agoTo be honest I was expecting different kind of content.
- rambojazz 4y agoWould love to read an explanation of this.
- throwoutway 4y agohttps://news.ycombinator.com/item?id=32128387 https://news.ycombinator.com/item?id=32128387