5 ms·

If you less this txt file, your terminal plays a sound

hsbauauvhabzb 4y ago
I’ve always been curious if mangling stdout or stderr can trigger bad actions, when cat-ing a binary file I occasionally see control characters on my prompt, could I get it to somehow type ‘rm -rf /‘?
- junon 4y ago
  Not unless your shell or terminal emulator somehow have custom escape codes that can do that, no.
  - unpopular42 4y ago
    Define "custom"
    - junon 4y ago
      E.g. iterm2 has a set of custom escapes that control aspects about the window. https://iterm2.com/documentation-escape-codes.html https://iterm2.com/documentation-escape-codes.html
- unpopular42 4y ago
  Probably. Might depend on your terminal emulator. See, for instance, CVE-2019-9535
- XMPPwocky 4y ago
  Modern terminals are not supposed to allow things like this (though there are bugs!) There's historically been stuff like "type the window title as if it was text entered on the keyboard"; since you can set the window title with escapes, this allowed Bad Things, and has subsequently been nerfed by major terminals (e.g. iirc xterm just reports "xterm" regardless of what the window title actually is)
- sublinear 4y ago
  Yeah I'm not a fan of the shell script piped to bash trend in readme files. I don't understand why they can't just distribute a package with the same install script.
  - hsbauauvhabzb 4y ago
    That’s not what I’m questioning at all, but it’s an invalid threat model unless you’ve audited every other file in the wider application
mtmail 4y ago
I'm guessing it contains https://en.wikipedia.org/wiki/Bell_character https://en.wikipedia.org/wiki/Bell_character ?
ignite 4y ago
That's because it has the beep character, which is non-visible, on lines 3 through 7 The beep character is control-g, ASCII 0x07
surteen 4y ago
This is Hacker News? A file with ^G in it makes the terminal play a sound?
- GauntletWizard 4y ago
  There's a lot of people in today's lucky 10,000[1]. "Terminal Bell" is a rarely used feature nowadays, because we've grown out of it, and yet - It's commonly supported. Hopefully from this a few young hackers will get the itch to go a little deeper into how our terminals are represented. [1]https://xkcd.com/1053/ https://xkcd.com/1053/
- icedchai 4y ago
  I remember learning about this in the 80's, when I got my first modem.
chomp 4y ago
0x07 = Bell
jdeaton 4y ago
Jokes on you my volume is off.
junon 4y ago
Person learns about the bell character, more at eleven.
XMPPwocky 4y ago
That's nothing- run `curl https://xmppwocky.net/curlme.txt https://xmppwocky.net/curlme.txt` on, say, OS X Terminal.app (and a lot of Linux terminal emulators, too) and your terminal window will do things like steal focus, maximize and minimize repeatedly, move around the screen... (don't do this on a terminal you care about! on some older versions of OS X, this would hard-lock the entire UI (for all apps, requiring a reboot or something!), but these days it's sufficient to force-quit Terminal) There's some wacky stuff out there: https://www.xfree86.org/current/ctlseqs.html https://www.xfree86.org/current/ctlseqs.html
- anthk 4y ago
  Not an issue with XTerm and IceWM.
pwg 4y ago
> If you less this txt file, your terminal plays a sound Actually, no it does not. My less displays the bell characters as ^G instead of showing them as raw. Whether you hear the bell, or simply see ^G, depends upon how you have less configured. I leave mine configured to use the caret notation for control characters (which for my version of less, is also the default).
mdmglr 4y ago
A good reminder to practice good opsec to be weary of packages that instruct you to `curl <url> | bash`. You never know what you're running.
- tzs 4y ago
  Worse, it is possible for the server to detect that you are doing that [1]. It could serve you malicious code when you "curl | bash" and then afterwards when you go to download a copy of the script to try to figure out what the heck it did the server could serve you benign code. [1] https://news.ycombinator.com/item?id=17636032 https://news.ycombinator.com/item?id=17636032
  - mdmglr 4y ago
    Oh wow that is good.

I’ve always been curious if mangling stdout or stderr can trigger bad actions, when cat-ing a binary file I occasionally see control characters on my prompt, could I get it to somehow type ‘rm -rf /‘?

junon 4y ago
Not unless your shell or terminal emulator somehow have custom escape codes that can do that, no.
- unpopular42 4y ago
  Define "custom"
  - junon 4y ago
    E.g. iterm2 has a set of custom escapes that control aspects about the window. https://iterm2.com/documentation-escape-codes.html https://iterm2.com/documentation-escape-codes.html
unpopular42 4y ago
Probably. Might depend on your terminal emulator. See, for instance, CVE-2019-9535
XMPPwocky 4y ago
Modern terminals are not supposed to allow things like this (though there are bugs!) There's historically been stuff like "type the window title as if it was text entered on the keyboard"; since you can set the window title with escapes, this allowed Bad Things, and has subsequently been nerfed by major terminals (e.g. iirc xterm just reports "xterm" regardless of what the window title actually is)
sublinear 4y ago
Yeah I'm not a fan of the shell script piped to bash trend in readme files. I don't understand why they can't just distribute a package with the same install script.
- hsbauauvhabzb 4y ago
  That’s not what I’m questioning at all, but it’s an invalid threat model unless you’ve audited every other file in the wider application

mtmail 4y ago

I'm guessing it contains https://en.wikipedia.org/wiki/Bell_character https://en.wikipedia.org/wiki/Bell_character ?

ignite 4y ago

That's because it has the beep character, which is non-visible, on lines 3 through 7 The beep character is control-g, ASCII 0x07

surteen 4y ago

This is Hacker News? A file with ^G in it makes the terminal play a sound?

GauntletWizard 4y ago
There's a lot of people in today's lucky 10,000[1]. "Terminal Bell" is a rarely used feature nowadays, because we've grown out of it, and yet - It's commonly supported. Hopefully from this a few young hackers will get the itch to go a little deeper into how our terminals are represented. [1]https://xkcd.com/1053/ https://xkcd.com/1053/
icedchai 4y ago
I remember learning about this in the 80's, when I got my first modem.

chomp 4y ago

0x07 = Bell

jdeaton 4y ago

Jokes on you my volume is off.

junon 4y ago

Person learns about the bell character, more at eleven.

XMPPwocky 4y ago

That's nothing- run `curl https://xmppwocky.net/curlme.txt https://xmppwocky.net/curlme.txt` on, say, OS X Terminal.app (and a lot of Linux terminal emulators, too) and your terminal window will do things like steal focus, maximize and minimize repeatedly, move around the screen... (don't do this on a terminal you care about! on some older versions of OS X, this would hard-lock the entire UI (for all apps, requiring a reboot or something!), but these days it's sufficient to force-quit Terminal) There's some wacky stuff out there: https://www.xfree86.org/current/ctlseqs.html https://www.xfree86.org/current/ctlseqs.html

anthk 4y ago
Not an issue with XTerm and IceWM.

pwg 4y ago

> If you less this txt file, your terminal plays a sound Actually, no it does not. My less displays the bell characters as ^G instead of showing them as raw. Whether you hear the bell, or simply see ^G, depends upon how you have less configured. I leave mine configured to use the caret notation for control characters (which for my version of less, is also the default).

mdmglr 4y ago

A good reminder to practice good opsec to be weary of packages that instruct you to `curl <url> | bash`. You never know what you're running.

tzs 4y ago
Worse, it is possible for the server to detect that you are doing that [1]. It could serve you malicious code when you "curl | bash" and then afterwards when you go to download a copy of the script to try to figure out what the heck it did the server could serve you benign code. [1] https://news.ycombinator.com/item?id=17636032 https://news.ycombinator.com/item?id=17636032
- mdmglr 4y ago
  Oh wow that is good.