这段使用 netcat 和管道创建 shell 的 bash 代码到底发生了什么?

发布于 2025-01-11 20:19:30 字数 472 浏览 0 评论 0原文

mkfifo /tmp/f ; cat /tmp/f | /bin/bash -i 2>&1 | nc -l -p 1234 > /tmp/f

我是 bash 新手,我试图理解这段“代码”。

  1. 为什么不需要 while 循环?这怎么行?它本身是一个循环吗?为什么?如何? 另外, cat filePipe 本身只打印一行,然后退出(我刚刚测试过),为了使 cat 不退出,我这样做: while cat pipelineFile ;做 : ;完成。那么上面的内容是如何工作的呢?
  2. 我不明白执行的顺序...开始时 /tmp/f 是空的,所以 cat /tmp/f 应该“发送”一个空流到 /bin/bash ,它只是将其发送到打开连接的 nc并将交互式 bash“发送”给连接的任何人...并且客户端的响应被发送到 /tmp/f ...然后呢?什么?它怎么能回去再做同样的事情呢?
mkfifo /tmp/f ; cat /tmp/f | /bin/bash -i 2>&1 | nc -l -p 1234 > /tmp/f

I am new to bash, I am trying to understand this piece of "code".

  1. Why a while loop is not needed? How can this work? Is it itself a loop? Why? How?
    Also, cat filePipe by itself ONLY PRINTS ONE LINE, and then exits (I just tested it), and to make cat not to exit I do: while cat pipeFile ; do : ; done. So how does that above work?
  2. I don't get the order of execution... at the beginning /tmp/f is empty, so cat /tmp/f should "send" an empty stream to /bin/bash which just send it to nc which opens a connection and "sends" the interactive bash to whoever connects... and the response of the client is sent to /tmp/f ... and then? What? How can it can go back and do the same things again?

如果你对这篇内容有疑问,欢迎到本站社区发帖提问 参与讨论,获取更多帮助,或者扫码二维码加入 Web 技术交流群。

扫码二维码加入Web技术交流群

发布评论

需要 登录 才能够评论, 你可以免费 注册 一个本站的账号。

评论(3

轻拂→两袖风尘 2025-01-18 20:19:30

当 bash 解析行 mkfifo /tmp/f 时;猫 /tmp/f | /bin/bash -i 2>&1 | nc -l -p 1234 > /tmp/f,发生了几件事。首先,创建 fifo。然后,不按特定顺序,发生 3 件事:cat 启动,bash 启动,nc 启动,其输出流连接到 <代码>/tmp/f。 cat 现在将阻塞,直到其他进程打开 /tmp/f 进行写入; nc 即将执行此操作(或已经执行了,但我们不知道 cat 是否会在 nc 之前启动,或者是否 cat 会在 nc 之前启动>nc 在 cat 之前开始,我们也不知道他们会以什么顺序打开 fifo,但无论谁先打开,都会阻塞,直到另一个完成操作)。一旦所有 3 个进程启动,它们就会坐在那里等待一些数据。最终,一些外部进程连接到端口 1234 并将一些数据发送到 nc,然后写入到 /tmp/f。 cat(最终)读取该数据并将其发送到下游的 bash,后者处理输入并(可能)将一些数据写入 nc,其中通过套接字连接将其发送回。

如果您有一个测试用例,其中 cat /tmp/f 仅写入一行数据,那是因为您使用的任何进程仅写入 /tmp/f写了一行。尝试: printf 'foo\nbar\nbaz\n' > /tmp/f & cat /tmp/f 或 while sleep 1;约会;完成> /tmp/f &猫/tmp/f

When bash parses the line mkfifo /tmp/f ; cat /tmp/f | /bin/bash -i 2>&1 | nc -l -p 1234 > /tmp/f, several things happen. First, the fifo is created. Then, in no particular order, 3 things happen: cat is started, bash is started and nc is started with its output stream connected to /tmp/f. cat is now going to block until some other process opens /tmp/f for writing; the nc is about to do that (or already did it, but we don't know if cat will start before nc or if nc starts before cat, nor do we know in which order they will open the fifo, but whoever does it first will block until the other completes the operation). Once all 3 processes start, they will just sit there waiting for some data. Eventually, some external process connects to port 1234 and sends some data into nc, which writes into /tmp/f. cat (eventually) reads that data and sends it downstream to bash, which processes the input and (probably) writes some data into nc, which sends it back across the socket connection.

If you have a test case in which cat /tmp/f only writes one line of data, that is simply because whatever process you used to write into /tmp/f only wrote a single line. Try: printf 'foo\nbar\nbaz\n' > /tmp/f & cat /tmp/f or while sleep 1; do date; done > /tmp/f & cat /tmp/f

烟雨扶苏 2025-01-18 20:19:30

/tmp/f 不是空的,而是一个 fifo,一个双向链接。

输入图片这里的描述

有人连接到端口 1234,输入一些内容,nc 将转发到 fifo,然后将其输入到 bash

bash 运行命令并将结果发送回 nc

/tmp/f is NOT empty, but a fifo, a bi-directional link.

enter image description here

Someone connects to port 1234, type something, which nc will forward to fifo which then feeds into bash.

bash runs the command and sends results back to nc.

长不大的小祸害 2025-01-18 20:19:30

.1 你误解了当你 echo "string" >/path/fifo 时会发生什么

。a) 当你只是 echo some >/path/to/somewhere 时,你

  • (然后测试可访问性)打开目标某处,用于
  • 在打开的文件描述符写入某些内容 EM> (fd)
  • 关闭(放松)访问的文件。

.b) fifo 第一个In是第一个第一个Out。)不是文件。

试试这个:

# 窗口 1:

mkfifo /tmp/fifotest
猫/tmp/fifotest

# 窗口 2:

exec {fd2fifo}>/tmp/fifotest
echo >&$fd2fifo Foo 酒吧

您将看到 cat 未终止

echo >&$fd2fifo Baz
执行 {fd2fifo}>&-

现在,cat 将关闭

所以不需要任何循环!

.2 命令cat /tmp/f | /bin/bash -i 2>&1 | nc -l -p 1234 > /tmp/f

可以写成(避免无用地使用 cat):

bash -i 2>&1 </tmp/f | nc -l -p 1234 > /tmp/f

但你也可以同样 操作,但来自 vue 的不同

nc -l -p 1234 </tmp/f | bash -i >/tmp/f 2>&1

目标是

  • nc驱动 bash 的 STDIN em>STDOUT 和
  • 重新连接 bash 的 STDOUTSTDERRncSTDIN

.3 更多:bashism

,您可以通过使用未命名的fifo来避免创建fifo

coproc nc -l -p 1234; bash -i >&${COPROC[1]} 2>&1 <&${COPROC[0]}

或者

exec {ncin}<> <(:); nc -l -p 1234 <&$ncin | bash -i >&$ncin 2>&1

.1 You misunderstand what happen when you echo "string" >/path/fifo

.a) When you just echo something >/path/to/somewhere, you

  • (test accessibility, then) open target somewhere for writting
  • write someting in openned file descriptor (fd)
  • close (relax) accessed file.

.b) A fifo (The First In is the First Out.) is not a file.

Try this:

# Window 1:

mkfifo /tmp/fifotest
cat /tmp/fifotest

# Window 2:

exec {fd2fifo}>/tmp/fifotest
echo >&$fd2fifo Foo bar

You will see cat not terminating.

echo >&$fd2fifo Baz
exec {fd2fifo}>&-

Now, cat will close

So there is no need of any loop!

.2 command cat /tmp/f | /bin/bash -i 2>&1 | nc -l -p 1234 > /tmp/f

could be written (avoid useless use of cat):

bash -i 2>&1 </tmp/f | nc -l -p 1234 > /tmp/f

but you could do same operation but from different point of vue:

nc -l -p 1234 </tmp/f | bash -i >/tmp/f 2>&1

The goal is

  • to drive bash's STDIN from nc's STDOUT and
  • connect back bash's STDOUT and STDERR to nc's STDIN.

.3 The more: bashism

Under , you could avoid creating fifo by using unnamed fifo:

coproc nc -l -p 1234; bash -i >&${COPROC[1]} 2>&1 <&${COPROC[0]}

or

exec {ncin}<> <(:); nc -l -p 1234 <&$ncin | bash -i >&$ncin 2>&1
~没有更多了~
我们使用 Cookies 和其他技术来定制您的体验包括您的登录状态等。通过阅读我们的 隐私政策 了解更多相关信息。 单击 接受 或继续使用网站,即表示您同意使用 Cookies 和您的相关数据。
原文