Aliases, command substitution and history
You define and remove aliases, do command substitution with $( ) and backticks and arithmetic with $(( )), use the shell history (!!, history, Ctrl+R); then you find and clean an alias hidden in .bashrc that harvests passwords, and pull out from another account’s history file the address the attacker downloaded a script from. The alias and the address differ in every lab.
Level 101 · 45 min
An administrator’s password leaked and nobody knows how. Daniel suspects the shell itself: "If an attacker adds a line to .bashrc, then when you type a command you use every day, it is really their code that runs."
An alias gives a long command a short name: alias ll='ls -alF'. Handy; but the same mechanism can quietly turn a command into something else. Aliases come before files: if there is an alias called sudo, the real sudo program doesn’t run.
The shell history is a treasure too: who typed which command? That is why attackers often try to wipe it.
What you will do in this lesson
- Define and remove an alias
- Command substitution: $( )
- Arithmetic: $(( ))
- History: history, !!, Ctrl+R
- Audit .bashrc
- Expose the alias: type
- Another account’s history
- The alias finding
- Clean up
- The source address
- Short quiz
Skills you will earn
- Defining and removing aliases
- Command substitution ($( ), backticks)
- Shell arithmetic ($(( )))
- Working fast with Tab completion, history and cd -
- Finding a malicious alias
- Editing and loading .bashrc (source)
- Asking what a command is (type, which -a)
- Tracing activity in history files
- Writing a short, precise finding
← Variables, PATH and .bashrc · Linux fundamentals · Editing files: first steps with nano and vim →
Start for free