`ls 2>/dev/null` cause file download

[guan4tou2]

`ls 2>/dev/null` cause file download

[micheloosterhof]

It was popular for a while (still might be) to pass files over stdin over the SSH tty channel to the destination. Then redirect that to a file and execute it. This saves it straight to the file rather than having to extract it from the keystroke log

https://www.cowrie.org/posts/2015-02-19-perl-stdin/

[WinterLily]

This seems to affect more than just ls, but redirecting as a whole.

It seems that you can use this to create persistent files on the host OS, which is kinda fun.

Testing from latest Docker build, running on Ubuntu 22.04:

Desktop> ssh [email protected] -p 2222
[email protected]'s password: 

The programs included with the Debian GNU/Linux system are free software;
the exact distribution terms for each program are described in the
individual files in /usr/share/doc/*/copyright.

Debian GNU/Linux comes with ABSOLUTELY NO WARRANTY, to the extent
permitted by applicable law.
root@svr04:~# touch file.txt 
root@svr04:~# echo "hello world" > file.txt

Check the Cowrie FS:

me@ubuntu: sudo ls -l /var/snap/docker/common/var-lib-docker/volumes/d359cfde6ef511f4d3fbf9e18b22128f609d6f856cdd1fcef8d74b2b52af6ade/_data/lib/cowrie/downloads
total 12
-rw-r--r-- 1 lxd 999      12 Jan  4 11:31 20240104-113138-572e7870aa31-0-redir__root_file_txt

Cat the file:

me@ubuntu: 
sudo cat /var/snap/docker/common/var-lib-docker/volumes/d359cfde6ef511f4d3fbf9e18b22128f609d6f856cdd1fcef8d74b2b52af6ade/_data/lib/cowrie/downloads/20240104-113138-572e7870aa31-0-redir__root_file_txt
hello world

[micheloosterhof]

Uhm, yes this is the purpose of this. There are certain commands executed that will download from the internet or do other operations, in this case the output of these commands is logged. Closing this ticket.

[WinterLily]

Apologies, but that doesn't quite answer why redirection in general is considered as a download and saved as such? Like I get why you'd want to save internet-downloaded files, for analysis and whatnot, but what's in question here is why redirection is considered a download.

[WinterLily]

Thanks! That makes more sense.