Arch Linux

dioltas

Member

Registered: 2009-06-03

Posts: 44

[SOLVED] ls as root tries to execute all filenames in directory

Bit of a weird one. As root, when I "ls" it tries to execute all the filenames in the directory.
/bin/ls works fine.

Been like this for a while, but finally decided to do something about it! Google didn't help me much.

$ ls
echo  touch
$ touch ls
$ touch wtf
$ ls
echo  ls  touch  wtf
$ touch thisisweird
$ ls
echo  ls  thisisweird  touch  wtf
$ su
Password: 
# ls

echo  ls  thisisweird  touch  wtf
bash: thisisweird: command not found
touch: missing file operand
Try `touch --help' for more information.
bash: wtf: command not found
# rm ls
# ls

echo  thisisweird  touch  wtf
bash: thisisweird: command not found
touch: missing file operand
Try `touch --help' for more information.
bash: wtf: command not found
# /bin/ls
echo  thisisweird  touch  wtf
# whereis ls
ls: /bin/ls /usr/share/man/man1/ls.1p.gz /usr/share/man/man1/ls.1.gz
# 

Same thing whether I su to root or login as root.

The folder whose files it executes seems to be the folder I su from as a normal user, or if I login as root, then a random folder I may have been working in in the past.

Any ideas?

Last edited by dioltas (2010-10-16 12:01:16)

ewaller

Administrator

From: Pasadena, CA

Registered: 2009-07-13

Posts: 19,804

Re: [SOLVED] ls as root tries to execute all filenames in directory

What do these commands yield for you?

ewaller@odin:~[125] 1038 %which ls
ls: aliased to ls --color=auto
ewaller@odin:~ 1039 %su
Password: 
[root@odin ewaller]# which ls
/bin/ls
[root@odin ewaller]# 

also, What is in root's $PATH ?

Last edited by ewaller (2010-10-14 23:06:17)

---

Nothing is too wonderful to be true, if it be consistent with the laws of nature -- Michael Faraday
Sometimes it is the people no one can imagine anything of who do the things no one can imagine. -- Alan Turing
---
How to Ask Questions the Smart Way

dioltas

Member

Registered: 2009-06-03

Posts: 44

Re: [SOLVED] ls as root tries to execute all filenames in directory

#which ls
/bin/ls

will post output of "echo $PATH" later. At work sshing to laptop from phone and it's too long to type.
/bin and /usr/bin are the first two entries though.

dioltas

Member

Registered: 2009-06-03

Posts: 44

Re: [SOLVED] ls as root tries to execute all filenames in directory

# echo $PATH
/bin:/usr/bin:/sbin:/usr/sbin:/opt/java/bin:/opt/java/jre/bin:/usr/bin/perlbin/site:/usr/lib/perl5/vendor_perl/bin:/usr/bin/perlbin/vendor:/usr/lib/perl5/core_perl/bin:/opt/qt/bin

/bin
/usr/bin
/sbin
/usr/sbin
/opt/java/bin
/opt/java/jre/bin
/usr/bin/perlbin/site
/usr/lib/perl5/vendor_perl/bin
/usr/bin/perlbin/vendor
/usr/lib/perl5/core_perl/bin
/opt/qt/bin

dioltas

Member

Registered: 2009-06-03

Posts: 44

Re: [SOLVED] ls as root tries to execute all filenames in directory

Checked all those directories and the only one of them with a "ls" is /bin.

This is weird.

Last edited by dioltas (2010-10-15 17:27:45)

ewaller

Administrator

From: Pasadena, CA

Registered: 2009-07-13

Posts: 19,804

Re: [SOLVED] ls as root tries to execute all filenames in directory

This is weird.

+1

A common attack on root is to leave commands with the same name as system commands laying around.  If root includes '.' in
their path, and they invoke a command like ls while in a directory that has a Trojan ls laying around, they can be rooted by the bogus command.  Thats what I was looking for, but it seems you are okay.

Unless you have really been rooted and which is lying, then something else must be going on. 

How about we try the big guns? Lets look at the output of strace ls

Last edited by ewaller (2010-10-15 18:32:00)

---

Nothing is too wonderful to be true, if it be consistent with the laws of nature -- Michael Faraday
Sometimes it is the people no one can imagine anything of who do the things no one can imagine. -- Alan Turing
---
How to Ask Questions the Smart Way

dioltas

Member

Registered: 2009-06-03

Posts: 44

Re: [SOLVED] ls as root tries to execute all filenames in directory

Yeah, that was one of the first thing that occurred to me too.

But if root and normal users are running the same binary then it should be ok I thought.

And it would be a weird attack making ls execute all the filenames...

Thanks for the strace suggestion! Will try this in the morning.

sisco311

Member

From: Romania

Registered: 2008-05-23

Posts: 112

Re: [SOLVED] ls as root tries to execute all filenames in directory

Check the aliases. My guess is that you used backquotes (`) instead of single quotes (') in an alias.

# alias ls

Last edited by sisco311 (2010-10-15 22:08:13)

---

don't drink unwashed fruit juice.
i never make predictions, especially about the future.

dioltas

Member

Registered: 2009-06-03

Posts: 44

Re: [SOLVED] ls as root tries to execute all filenames in directory

When I saw your post first, I thought no, I definitely don't have any aliases set up for root.

then tried alias ls. Had a look at /etc/bash.bashrc at there it was

alias ls=`ls --color=auto`

Thanks for your help!

Have no recollection of adding that. I feel like an idiot now!

jdarnold

Member

From: Medford MA USA

Registered: 2009-12-15

Posts: 485

Website

Re: [SOLVED] ls as root tries to execute all filenames in directory

An easy way to make sure you're not using an alias is to use a backslash when running the command:

#\ls

ewaller

Administrator

From: Pasadena, CA

Registered: 2009-07-13

Posts: 19,804

Re: [SOLVED] ls as root tries to execute all filenames in directory

Note to self:  I had thought the which command would reveal the alias.  I realize now this is an artifact of zsh and it behaves differently in bash.

Good call Sisco311.
jdarnold:  Good tip, I had never seen that

---

Nothing is too wonderful to be true, if it be consistent with the laws of nature -- Michael Faraday
Sometimes it is the people no one can imagine anything of who do the things no one can imagine. -- Alan Turing
---
How to Ask Questions the Smart Way