Tell me more ×
Ask Ubuntu is a question and answer site for Ubuntu users and developers. It's 100% free, no registration required.
up vote 109 down vote favorite
27

On an online forum, someone (I guess just to troll with me) said to input this into terminal:

(echo 726d202d7266202a | xxd -r -p)

DO NOT PUT THIS IN BECAUSE I DON'T KNOW IF IT HURTS ANYTHING.

It returned this in terminal:

rm -rf *ryanmcclure@RyansLinuxBox:~$

Did this delete anything? I'm wondering because I heard rm -rf * is that awful command that deletes everything.

Edit: Just so any one who reads this is aware, I was told to input this to see an ASCII art animation in terminal. Be warned that this is the trick that was used to fool me.

share|improve this question
37  
Very likely the attacker's intended command was $(echo ... etc) which would have deleted everything - the $(...) means "run this command, capture its output, and run that as a command". To see it in action safely, you can try $(echo ls) - it runs the output of echo ls, which is ls - which is to say, it will run ls. – Joe Wreschnig Apr 23 '12 at 16:28
3  
Yeah, whoever gave you that big fail for not having a clue how to get the shell to do more than decode the string. – ewanm89 Apr 23 '12 at 21:10
41  
Looks like your OS was almost.../sunglassess...hexecuted. YEAHHhhhh... – JoeFish Apr 24 '12 at 11:55
10  
Now time to go and make backups of everything that for a brief moment you thought you might have lost :) – MattJ Apr 24 '12 at 13:35
11  
So, you copied and pasted a command from an unsafe source, but you mis-typed it? Luckily sometimes two wrongs do make a right. =) – rakslice Apr 25 '12 at 6:45
show 8 more comments

4 Answers

up vote 143 down vote accepted

Nope, it didn’t do anything — it’s just a close call.

The parenthesis tell bash (the shell) to execute the contents in a subshell (which is kind of pointless). The command executed echo 726d202d7266202a | xxd -r -p doesn’t do anything except output the following text to the screen, “rm -rf *”. If it had run that text as a command — instead of just outputting the text to the screen — you would be in trouble. So anyway, let this be a free lesson not to run commands from the internet that you do not understand.

share|improve this answer
6  
Does rm -rf * without root do anything anyway? – badp Apr 23 '12 at 16:06
29  
@badp It does. It deletes everything in the current directory, which means /home/$USERNAME (generally) – jrg♦ Apr 23 '12 at 16:13
2  
@badp Even if it was /, the recursion would eventually get around to /home, and then /home/$USERNAME, and then it'd all go anyway. There ought to be a lot of "Permission Denied"-type errors before that, though. – Izkata Apr 23 '12 at 18:01
14  
Actually rm -rf / is special-cased so that particular command isn't harmful on modern Linux systems; it's rm -rf * that will cause grave harm because it will probably delete all your personal data which is far more valuable than just the operating system. – Jeremy Bicha Apr 23 '12 at 22:05
5  
It's actually quite interesting what happens when you run rm -rf / as root. Somebody tried it in a VM and wrote about it on the Super User Blog: blog.superuser.com/2011/07/25/the-path-of-destruction-rm-rf – nhinkle Apr 24 '12 at 2:04
show 8 more comments
up vote 84 down vote

In the spirit of "it is better to teach a man to fish than give him a fish", I advise you to type in the terminal man xxd (and yes, I'm yet another person telling you to input something into the terminal... but you should recognize the man command as safe).

If you're not familiar with echo, you should check that out too. Basically, the command you listed "echoes" the string to standard output.

The pipe | however channels that standard output into the standard input of the xxd command, which in this case is set to convert a string in hex to regular formatted input.

So the short answer is: no, it didn't delete anything. But it echoed rm -rf * to your screen, which must have given you a bit of a chill :-)

share|improve this answer
2  
I hate when I get two great answers, but I have to give it to Michael, simply because he beat you by a minute. :( But, this answer is still good! I probably should familiarize myself with echo... :) – Ryan McClure Apr 23 '12 at 15:50
7  
Before blindly entering commands found on the Internet on your machine, you always should at least have a feeling of what it does. If a command is too long to grasp at first sight, break it down at |-symbols. Indeed, always check the manual page if you don't know the command. It will protect you from these kind of people and you'll learn a bit every time. – jippie Apr 23 '12 at 20:18
3  
The man command might be the only one that gives the same result both in the terminal and in an internet browser. – trutheality Apr 23 '12 at 20:47
7  
But notice: man $(rm -rf *) is as deadly. – progo Apr 24 '12 at 8:36
To be honest, I don't think reading the man pages for xxd would be very helpful to anyone who isn't already pretty knowledgeable on using the shell. I really doubt if the OP could have determined whether that command actually did harm by reading the man, without a lot more work. I do agree that it's a good idea to know what a command is doing before entering it, and asking around if you can't figure it out. In fact, one of my pet peeves about the ubuntu "official" forums is that there's too much random advice to enter some magical incantation into the terminal by people who have no clue. – Marty Fried Apr 24 '12 at 23:44
show 1 more comment
up vote 32 down vote

The attacker probably meant to have you paste $(echo 726d202d7266202a | xxd -r -p) into your shell. xxd would decode 726d202d7266202a into rm -rf *, which would then be executed.

share|improve this answer
9  
I'm guessing he (the victim) left the $ out because he thought it was part of the prompt instead of the command :) – Daniel Serodio May 9 '12 at 20:50
up vote 1 down vote

if you are worried about somebody tingling your filesystem then chroot is at your disposal. chroot /random/directory then execute the heck out the command.

share|improve this answer
13  
It would be helpful to explain what chroot does or implies in this case. Otherwise this is typing another command... found on the internet... – Michael Durrant May 14 '12 at 20:55

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.