2

I do this little file based on a combination of hexadecimal, that can broke cat and the terminal showing the file with cat; reset does not worked anymore, it is maybe putting cat in a kind of loop? Please someone can explain? It will not cause any issue but don't run it on production, because it can have some side effects that I did not see:

Download Cat Killer Version 1

Do the command "cat brokecat" and you will see.

Maybe this is a security issue with cat, that can execute arbitrary code?

Another example: cat /usr/bin/vi can execute some commands not found at the end!

Is there a more secure way to run cat?

|improve this question
3

You could do cat -v /usr/bin/vi to have it print the unprintable characters as ASCII representations, not as actual control characters that the terminal may try to process. Does that solve your problem?

|improve this answer
  • Yes very better now! I will look the servers log using that, i imagined a hypothetical situation that a user type some characters on server uri of apache, and a look on access.log execute arbitrary commands, and broke the server(it did not happen but..)! By curiosity i am trying also to do exactly that, no success, but maybe i am missing a thing. – Luciano Andress Martini May 17 '16 at 17:58
  • @LucianoAndressMartini I don't have any insight for you on how to do it, but I love the idea. You might also want to look around on security.stackexchange.com for like minded investigators if you're interested in that sort of research/work – Eric Renouf May 17 '16 at 18:12
  • Thank you very much, lets take a look together on that, maybe we can discover something new or is just some crap in my thinks. (sorry if i have a bad english) – Luciano Andress Martini May 17 '16 at 18:16
  • As you recommend here is the link security.stackexchange.com/questions/123559/… – Luciano Andress Martini May 17 '16 at 18:39
  • @LucianoAndressMartini sorry, I wasn't suggesting this exact question would fit there, but the idea you're exploring made me think you might find some people to help or to flesh out other ideas you come up with there – Eric Renouf May 17 '16 at 19:18
1

You really shouldn't be 'cat'ing arbitrary files. It's a bad idea even if the file is not malicious.

You can determine the file 'type' by running the 'file' program, e.g. file /usr/bin/vi. Using 'cat' is kind of low-level anyway. Perhaps try using 'more' or 'less'. When I try more /usr/bin/vi I get /usr/bin/vi: Not a text file.

Also, you can reset your terminal with the "reset(1)" command, but you may have to type resetC-J, i.e. the string "reset" followed by a "control-J", if the terminal ends up in raw mode.

|improve this answer
  • Yes! it looks like a bad idea, special looking in apache logs, do you imagine? I am thinking in the possibility of making cat to execute commands remotely in my server, when looking to the access.log files.. i know it will be hard, but i am trying, for security purposes! – Luciano Andress Martini May 17 '16 at 18:08
  • I tried the reset + control + J and it did not work! – Luciano Andress Martini May 17 '16 at 19:32
  • Does the "reset" + "control-J" work when in the normal terminal? It should. If it does not, then try "tput reset" + "control+J". – Lee-Man May 17 '16 at 22:11
  • And use something safer, like the 'less(1)" command. Or you could just always use "cat -v", but who wants to see binary data, even if it does not screw up your terminal. – Lee-Man May 17 '16 at 22:12

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.