Gentoo Forums
Gentoo Forums
Gentoo Forums
Quick Search: in
Strange command in .bash_history: I=poiu
View unanswered posts
View posts from last 24 hours

 
Reply to topic    Gentoo Forums Forum Index Networking & Security
View previous topic :: View next topic  
Author Message
trikmik
n00b
n00b


Joined: 06 Nov 2017
Posts: 45

PostPosted: Sun Nov 19, 2017 8:33 am    Post subject: Strange command in .bash_history: I=poiu Reply with quote

I saw this command in my bash history:
Code:
i=poiu

I don't think i did that, or maybe by accident pressing my keyboard..

Does anyone knows what that command is related to?

[i][Moderator note: added Strange command in .bash_history: to original poster's title of I=poiu to clarify the point of the thread. -Hu]/i]
Back to top
View user's profile Send private message
trikmik
n00b
n00b


Joined: 06 Nov 2017
Posts: 45

PostPosted: Sun Nov 19, 2017 1:17 pm    Post subject: Reply with quote

When i type something Random in bash:
Code:
djdjdjv

The output is; -bash: djdjdjv: command not found

I=poiu

Turns out nothing, so this command must do something?

I was upgrading gentoo ~amd64 Systemd and when the upgrades was done, the last command used was twice the i=poiu

All i can think of is something like;
I=(insert)p(Point)o(of)i(intrest)(u)you
That emerge might leaked to bash, if that is possible..

I would like to know what this command is, and how it got in bash history twice in a row.
Back to top
View user's profile Send private message
Section_8
Guru
Guru


Joined: 22 May 2004
Posts: 547
Location: Arlington, TX, US

PostPosted: Sun Nov 19, 2017 2:53 pm    Post subject: Reply with quote

I don't see anything like that in my command history. Maybe the reason it doesn't get a "command not found" error is because it has the syntax of a bash assignment statement. Any command of the form "x=y" I enter also does nothing.

Last edited by Section_8 on Sun Nov 19, 2017 3:03 pm; edited 1 time in total
Back to top
View user's profile Send private message
trikmik
n00b
n00b


Joined: 06 Nov 2017
Posts: 45

PostPosted: Sun Nov 19, 2017 3:02 pm    Post subject: Reply with quote

Yes, but the question remains how that command came in bash history?

I do not think it was me accidently pressing Keys, because it was twice in a row.

*Edit* if i did accidently pressed x=y wich indeed prints nothing, how did it show up in bash history twice like:
I=poiu
I=poiu

I was home alone during the install and was taking a shower with the box having root open and connected to the internet running emerge, did i got hacked?
Back to top
View user's profile Send private message
Hu
Moderator
Moderator


Joined: 06 Mar 2007
Posts: 11426

PostPosted: Sun Nov 19, 2017 4:26 pm    Post subject: Reply with quote

As Section_8 says, this is a valid bash input. It sets variable I (or i, depending on capitalization; you have used both in the thread) to value poiu. That variable has no inherent meaning to bash, so someone running bash must have entered it. On a qwerty keyboard (as well as on azerty keyboards), poiu occupy adjacent keys in a line running right-to-left, which could explain the choice of letters.

As for whether you got hacked, we have insufficient information to answer that. If you did, whoever did it was exceptionally bad at it. Did you have sshd running on an Internet-accessible port? What install media did you use? Was sshd configured to permit root login?
Back to top
View user's profile Send private message
trikmik
n00b
n00b


Joined: 06 Nov 2017
Posts: 45

PostPosted: Sun Nov 19, 2017 5:30 pm    Post subject: Reply with quote

Thank you for your input.

If poiu has no meaning, and it is indeed in line on keyboard, i must have accidently hit my keyboard while compiling, and this alone is not a sign of a owned box.

Thanks thread solved
Back to top
View user's profile Send private message
Display posts from previous:   
Reply to topic    Gentoo Forums Forum Index Networking & Security All times are GMT
Page 1 of 1

 
Jump to:  
You cannot post new topics in this forum
You cannot reply to topics in this forum
You cannot edit your posts in this forum
You cannot delete your posts in this forum
You cannot vote in polls in this forum