Spoofing Attack in Script

Heard of SQL-injection (SQLi)? Do you know we can do script injection, similar to SQLi? Here is how to protect the shell script from injection attack.

First, check out what is SheBang if you haven't heard of it.

Second, sometime you will notice some SheBang will end with - or --.

#!/bin/bash -

#!/bin/bash --

The purpose of the single-dash is to protect it from script injection. IT simply mens the end of the options and disable any further option processing. Any argument after the --   is treated as filenames and arguments

This can protect the script from setuid based root spoofing and avoid interpreter spoofing, and eventually improve script security.

 

* Many OS ignore the setuid attribute when it detects shebang in an executable shell scripts.

Links:

• https://www.cyberciti.biz/faq/binbash-interpreter-spoofing/
  
• https://www.in-ulm.de/~mascheck/various/shebang/
• http://www.faqs.org/faqs/unix-faq/faq/part4/section-7.html
• https://unix.stackexchange.com/questions/364/allow-setuid-on-shell-scripts
  

Portable SheBang

To make a portable SheBang across different UNIX OS, we can use /usr/bin/env command as shebang. For example:

#!/usr/bin/env bash

#!/usr/bin/env perl

#!/usr/bin/env python

The advantage is, it will use whatever interpreter executable appears first in the running user’s $PATH variable. 

To locate a full or exact path, like env,  we can use 3 commands:

$ type env

$ command -V env

$ which env

Links:

• https://www.cyberciti.biz/tips/finding-bash-perl-python-portably-using-env.html
  

SheBang

Shebang starts with #! characters and the path to the bash or other interpreter of your choice. Let us see what is Shebang in Linux and Unix bash shell scripts. 

The #! syntax is used in scripts to indicate an interpreter for script execution. The directive must be the first line of script and must start with shebang #!. You can add argument after the shebang characters, which is optional. Make sure the interpreter is the full path to a binary file. 

For example: 

#!/bin/bash

#!/bin/bash -x 

#!/usr/bin/env python

 

To ignore SheBang, just override the SheBang at the command line.

$ python2 hello_world.py

Links:

• https://bash.cyberciti.biz/guide/Shebang