2

I was wondering if there are any vulnerabilities that I may face when using "wget" and its options. And specifically, I've used a benchmarking script to test the performance of my VPS. The command is as follows:

wget -qO- bench.sh | bash

I know what the -q0- does, but couldn't find any resource explaining the "bash" parameter at the end of the command.

  • Shouldn't you specify a server to download something from? Or is bench.sh the server? – nohillside Dec 3 '18 at 19:28
  • bench.sh is the server – Sepehr.e Dec 3 '18 at 19:29
  • 4
    Well one "vulnerability" with wget is you are downloading things over the internet and from the looks of your example piping the results of what you download straight into bash which means you will be most likely executing whatever you are downloading over the internet with whatever rights your user has. – kemotep Dec 3 '18 at 19:30
  • 2
    There are no known security vulnerabilities with Wget directly. However, you piping the download directly to bash can cause many problems. For example, see this exploit here: idontplaydarts.com/2016/04/detecting-curl-pipe-bash-server-side While it mostly talks about curl, the exact technique holds true for Wget as well – darnir Dec 3 '18 at 22:27
3

A command such as

wget -qO- bench.sh | bash

means "get a file from bench.sh and run it with bash".

This is effectively the same as

wget -q -Otestfile bench.sh
bash testfile

but without needed the temporary file.

So what you are doing is downloading and running untrusted code. Today you can download the file and check it for "nasty" commands, but will it still be clean tomorrow? Or the next day?

Is this a security concern? Potentially.

You need to decide on how much you trust the people running bench.sh and how likely it is that someone will try and break into the server and make unauthorised changes. Also note the connection is via http so is potentially open to a "man in the middle" attack, changing the data as it is sent to your computer.

I, personally, don't run scripts that way; but I know many people who do.

  • Thanks, man. It seems I'm in a lot of trouble. Is there any chance you could take a look at the script and see if there is anything wrong with it? What steps should I take now that I have done this mistake to ensure that I'm safe? – Sepehr.e Dec 3 '18 at 19:41
  • @Sepehr.e run wget -q -O bench.sh bench.sh and have a look at it. – nohillside Dec 3 '18 at 19:42
  • @nohillside I took a look. But I'm new to this stuff. There's a lot going on in the script! I'd appreciate some help. – Sepehr.e Dec 3 '18 at 19:46
  • The script I just downloaded looks safe. But that's not any evidence that this is the same script that you downloaded! You're probably OK... probably! – Stephen Harris Dec 3 '18 at 20:09
  • 1
    @Sepehr.e Try to look at it piece by piece, and ask new questions for things you don‘t understand. But don‘t post the whole script and ask for help, this will not lead to answers. – nohillside Dec 3 '18 at 20:10
2

The bash is not a parameter of wget. What's happening here is that you are downloading something with wget and passing it to bash for running.

Yes, there is a security issue here. The issue is that you are running a shell script fetched from somewhere without looking at the script itself. If you are getting the script with wget from some form of trusted source, then this may be ok. If not, then I'd suggest downloading it to a file first, inspecting it, and then running it as a shell script if you think it is safe to do so.

There have been trojans distributed as shell scripts that require the user to download the script and run it. Linux.MulDrop.14 (a bitcoin miner) is one such script, targeting older Raspberry Pi.

1

What -qO- basically does is

-q,  --quiet                     quiet (no output)

run quietly (doesn't produce any log/diagnostic output)

-O,  --output-document=FILE      write documents to FILE

send the output (the downloaded file) to - which is stdout by default.

So whatever you download gets piped into bash for execution.

If somebody hacks the server and replaces the script with rm -rf ~ (or similar) all your files will be lost. It depends on the environment you are in to assess whether this is an issue or not.

To analyze what the script does you can download it with

wget -q -O bench.sh bench.sh

and then open bench.sh in a text editor to look into it.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.