muesliTIL: #bash provides pseudo devices for TCP and UDP connections:
echo "hello" > /dev/udp/127.0.0.1/1337
or
exec 5<>/dev/tcp/www.google.com/80
echo -e "GET / HTTP/1.0\n" >&5
cat <&5
I'm baffled how I've never discovered that until today.
CLARJON1.EXE 
@fribbledom Woah, that's pretty dang slick.
taylor@fribbledom oh this is bash? i thought it was the kernel that provided that
I don't think it is the kernel... unless those udev rules only apply to bash for some weird reason.
Just did a quick test trying that in zsh and it failed.
Jasper 🍉@fribbledom @nik starting bash, your second command works, but `ls /dev/tcp` or `/dev/udp` yields nothing, maybe that's why you didn't notice?
Seems like a rather irregular thing to do tbh.. But then i wouldn't know.
Sajith@fribbledom Special handling of certain file names is for redirections, and it is a Bash feature.
"Bash handles several filenames specially when they are used in redirections, as described in the following table. If the operating system on which Bash is running provides these special files, bash will use them; otherwise it will emulate them internally..."
https://www.gnu.org/software/bash/manual/html_node/Redirections.html
rugk OLD ACCOUNT
wuffel
ottonafo 🇺🇦@fribbledom ha, brilliant, didn't know that! though i'd still go with #python
@fribbledom i've used this for data recovery before
i accidentally overwrote my luks header, lvm header, and a large chunk of my root partition, so i had nearly no chance of recovering my system if i shut it down
so what i was left with was one bash session, in a tty, loaded into memory, and nothing else. no cat, no ls, no cp, no utilities whatsoever aside from bash. my first instinct after digging around was to use /dev/tcp to put a static rsync on this machine, then get my files off (as networking was still functional). but to use /dev/tcp to bring a file over, you need some way to redirect from /dev/tcp as stdin, to a file, and there is no way to do this in pure bash, you need something like cat.
so i wrote a program in asm that piped stdin back to stdout, compiled it, converted it to hex, put it on an arduino micro (atmega 328p, keyboard emulation), which then typed the hexcode of the program into the console. i then put this hex into an executable file i had on my home partition (still mounted), and used it with /dev/tcp and netcat on my laptop to copy a static rsync to my desktop, which i then used to copy my files over
if you're curious, the files i wanted that weren't backed up were my music library.
i accidentally overwrote my luks header, lvm header, and a large chunk of my root partition, so i had nearly no chance of recovering my system if i shut it down
so what i was left with was one bash session, in a tty, loaded into memory, and nothing else. no cat, no ls, no cp, no utilities whatsoever aside from bash. my first instinct after digging around was to use /dev/tcp to put a static rsync on this machine, then get my files off (as networking was still functional). but to use /dev/tcp to bring a file over, you need some way to redirect from /dev/tcp as stdin, to a file, and there is no way to do this in pure bash, you need something like cat.
so i wrote a program in asm that piped stdin back to stdout, compiled it, converted it to hex, put it on an arduino micro (atmega 328p, keyboard emulation), which then typed the hexcode of the program into the console. i then put this hex into an executable file i had on my home partition (still mounted), and used it with /dev/tcp and netcat on my laptop to copy a static rsync to my desktop, which i then used to copy my files over
if you're curious, the files i wanted that weren't backed up were my music library.
I like the way you're thinking! 😊
@fribbledom this took 5-6 hours to pull off, i didn't cover all the other things i tried before this...
Bobo_PK 🦄@nik @fribbledom that is pure Mac Guyver level of recovery. If I ever fuck up my LUKS I need to toot you
schnittchen 🏳️🌈🐆@fribbledom
Super nice when scripting to check whether some service has finished booting up!
Super nice when scripting to check whether some service has finished booting up!
Anthony Sorace@fribbledom Ick. gawk too, IIRC. Should bu system level, so everything has access (like Plan 9, as noted elsewhere).
Baggypants@fribbledom
I've known about it, but it's like knowing what's in the Necronomicon, it's powerful, but nothing good will come from it.
I've known about it, but it's like knowing what's in the Necronomicon, it's powerful, but nothing good will come from it.
penguin42@fribbledom I think some builds compile it out because they're scared that any shell script being able to access the net could unwrap security issues no one really thought of
gws@penguin42 @fribbledom Yeah, with netcat flagged by AV if it was built with the `-e` option enabled, I will be a little surprised to see this work in a vanilla installation without extra work to turn it on. "Will" and not "would" because *of course* it's been there all the time without anyone getting wise.
midnight@fribbledom Huh. How about that. Even on the *BSDs.
Михаил@fribbledom
QNX has another good possibilities known as Qnet
http://www.qnx.com/developers/docs/6.5.0/index.jsp?topic=%2Fcom.qnx.doc.neutrino_sys_arch%2Fqnet.html
QNX has another good possibilities known as Qnet
http://www.qnx.com/developers/docs/6.5.0/index.jsp?topic=%2Fcom.qnx.doc.neutrino_sys_arch%2Fqnet.html
io_err 
@fribbledom whoa that's bizarre, from the manpage description I wonder if they did it to mimic some previous OS functionality that they wished were available on all platforms
that exec syntax in the first line of the second example is strange! anyone know what it's called or how I could learn more about it?
also how would you close the network connection created in the second example?
wild stuff damn
Kitteh@[email protected] someone made a TLS implementation in bash which used these for https