3

I'm doing the Shellshock lab, the tutorial gives an approach to pass a function to child process by environment variable:

$ foo='() { echo "hello"; }'
$ export foo
$ /bin/bash
$ foo
hello

However, when I tried this on my Ubuntu 20.04, foo was not converted to a function in the child process.

$ foo='() { echo "hello"; }'
$ export foo
$ /bin/bash
$ foo
Command 'foo' not found, did you mean: ...

Is there anything I missed, or this approach only works for certain versions of bash?

0

2 Answers 2

6

In Bash you define a shell function like so:


name () { ...; }

or like so:

function name { ...; }

and a multi-line one would look like this:

name ()
{
...
...
}

or like this:

function name
{
...
...
}

and is exported with -f like so:

export -f name

So, declare your function like this:

foo () { echo "hello"; }

and then export it like this:

export -f foo

Technical Notice

That said, what you describe resembles a historical vulnerability that used to exist in Bash (particularly in the "function export" feature/mechanism syntax and subsequent parsing) about a decade ago but has been fixed long ago too so not applicable in Bash anymore unless you somehow still have an non-patched/non-updated version of Bash all that time on your system.

Please see:

1

Since Bash 4.4, functions are now exported as BASH_FUNC_foo%% instead of just as foo. This isn't a valid shell variable name, so you can't set it directly within Bash, but you can with other commands such as env, e.g., with env BASH_FUNC_foo%%='() { echo "hello"; }' /bin/bash.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .