Discussion on question by Paranoid Panda: When run cat says: "Hello, nothing to see here! Move along!"

6:53 AM

10

Q: When run cat says: "Hello, nothing to see here! Move along!"

Today when I ran the cat command, instead of the contents of a file, I got: Hello, nothing to see here! Move along! I have checked to make sure that the cat file has not been changed after the last time I used it, so I am certain that the cat file in /bin has not been changed, so something el...

Thomas W.

Check your bash aliases, and see if someone is playing a joke on you and changed what 'cat' does by an alias?

user136984

@ThomasW.: They would have to be root to edit that, or my .bashrc file, so it is very unlikely.

muru

@ParanoidPanda or a paranoid panda forgot to lock their session before going for coffee.

Thomas W.

@ParanoidPanda check it anyways. I've done this kind of thing as a prank on friends before, so i'm well familiar with people not locking their sessions and such.

user136984

@ThomasW.: I have checked, and nothing is unusual there, and my .bashrc file points to the correct aliases file, so it is not that.

user136984

6:53 AM

@muru: That would definitely never happen with my level of paranoia! :D

muru

Ok. Add the output of type cat, strings cat, cat .bashrc.

Jos

FYI In my 15.04 installation, which cat gives /bin/cat; ls -l /bin/cat gives -rwxr-xr-x 1 root root 52000 nov 3 2014 /bin/cat. Furthermore, openssl dgst -md5 /bin/cat gives MD5(/bin/cat)= f8fec5f7d388af6a31c34ee86f256e6f. Hope this helps.

user136984

@muru: Are you sure you don't want me to use another tool to get the contents of .bashrc, because the output of that is just Hello, nothing to see here! Move along!?

user136984

@Jos: If I am looking at the possibility of some sort of malicious change, or at least someone doing this on purpose, then using something like SHA256 would be safer as opposed to MD5, as that is insecure, and should not longer be used.

Jos

Fair enough. SHA256(/bin/cat)= a80c46f9c73190d6b46bdf444ade76d05ce113a21dbab7b805dde5027816aa48

muru

6:53 AM

Get the coreutils package and diff the cat. Assuming diff isn't compromised. Also, I meant strings $(command -v cat), not strings cat, sorry.

levlaz

If you run less /bin/cat does it pop out a binary file?

user136984

@levlaz: Yes, a binary file.

user136984

@Jos: The sha256sum for my cat file is the same as the hashsum you gave me.

waltinator

You could see if cat is an alias alias | grep cat, and if you are getting cat from the right place type -p cat, echo $PATH. Use another tool (less, more, od -bc) to ensure that the contents of the file have not been replaced with "` Hello, nothing to see here! Move along!'".

user136984

@waltinator: As it has the same hash as Jos' one, I assume that it is the right cat.

waltinator

6:53 AM

But which cat are you running? Try /bin/cat and my other checks above.

user136984

@waltinator: cat is not an alias. I have already edited my question to include what the output of type cat is. The extra -p option does not appear to make a difference to the output. And the echo $PATH command outputs what it normally does.

kos

If you want to just get at the bottom of it , run this: sudo find / -type f -exec grep 'Move along!' {} \; | grep matches , it might take a while

Nykakin

What about checking strace cat?

waltinator

The strings command shows that the cat you are actually using is a shell script that simply echoes the message. If type cat and type -p cat do not give different answers, I must wonder what $SHELL you are using. The cat you are using, and /bin/cat are not the same program.

Jos

Try /bin/cat file and see if you get the same message.

Byte Commander

6:53 AM

What is your output of which cat?

user136984

@kos: That just gives lots of these, but doesn't actually give m any files containing that:

grep: /proc/sys/fs/binfmt_misc/register: Invalid argument grep: /proc/sys/net/ipv4/route/flush: Permission denied grep: /proc/sys/net/ipv6/route/flush: Permission denied grep: /proc/sys/vm/compact_memory: Permission denied grep: memory exhausted grep: /proc/sysrq-trigger: Input/output error grep: /proc/1/task/1/mem: Input/output error grep: /proc/1/task/1/clear_refs: Invalid argument grep: memory exhausted

user136984

@Nykakin: I have edited my question to include that information.

kos

That was expected without redirecting stderr, however try this instead: sudo find / -type f -exec strings -f {} \; 2>/dev/null | grep 'Move along!'

user136984

@kos: Ok, I am running that now, and will let you know of the results.

Nykakin

Wait... if the output of strings $(command -v cat) is a bash script then what is the output of command -v cat...?

Jos

6:53 AM

Your strace looks the same as mine, although several numerical values are different.

user136984

@Nykakin: The output of that is /bin/cat, but I have already established that that file has the correct sha256sum etc, and is what it should be.

user136984

@Jos: What would they be?

Jos

Most hex strings are different, and mine starts with "59 vars" where yours has "61 vars". Can't tell what that means though.

Nykakin

Is LD_PRELOAD variable empty? Check it with echo $LD_PRELOAD.

user136984

@Jos: the output of the find command is nothing.

user136984

6:53 AM

@Nykakin: Yes, that variable is empty.

Nykakin

Well, the last idea I have is to run strace again but this time with more verbose output and an actual file argument - strace -vs 1024 cat somefile (assuming that cat somefile gives that message instead of valid file content).

user136984

@Nykakin: strace is now just crashing the machine and not actually giving me anything.

Stunts

I would also recommend checking ~/.bash_profile and ~/.profile... bash also sources these files on startup. You can also try to run a different shell (zsh, dash, whatever) and check if the issue persists. If it does, you know it's something that affects multiple shells, and if it doesn't you'll know it's bash specific, which should help narrow things down.

user136984

@Stunts: ~/.bash_profile does not exist, and ~/.profile seems fine. And yes, it does appear to affect multiple shells.

Stunts

Ok, so can you try and see if it also happens with another user? That should give us full scope of the problem.

user136984

6:53 AM

@Stunts: I already checked that, and it does not.

Stunts

Ok, so this is something local (you user only) and multiple shells. Can you please post the output of echo $PATH? I am inclined to blame some environment variable, I just don't know which. printenv might prove usefull to pin point it (I don't think it outputs any sensitive information, but please double check it before posting).

user136984

@Stunts: Ok, I have added that information to my question.

kos

You mis-notified Jos in place of me, however have you tried Jos' suggestion (i.e. /bin/cat file)?

JoKeR

@ParanoidPanda I'm not really sure but I found this link at GitHub where the guy tells of creating http handler couch_db where the first step: We define the module name, nothing to see here, move along. Maybe could it be somebody played this way with your cat command? etc.

Also when I googled your cat output command this website popped up.

kos

However no one mentioned /etc/bashrc or /etc/profile; it really looks like something played a prank on you, so make sure to check those files either, it might have been done on purpose to obfuscate the thing a bit, since the first thing you think of is usually ~/.bashrc or ~/.bash_profile

user136984

6:53 AM

@kos: /etc/bashrc does not exist, and /etc/profile looks fine.

Nykakin

If strace crashes then try lowering its parameter: strace -vs 512 cat somefile or strace -vs 256 cat somefile.

user136984

@Nykakin: That still crashes it, although there is lots of output and among that is the message I see when I run cat, but there is a mass amount of output, and both commands completely crash the whole thing...

Nykakin

Can you put it on the pastebin?

Stunts

Something there is taking us somewhere: strings $(command -v cat). Try this without the "strings" part - ie. command - v cat. This has to be something local. Also, please post ls /home/neo/jdk1.8.0_45/bin which seems to be the only local location in your $PATH.

user136984

4:55 PM

@Nykakin: There is too much of it to do that, and I have tried pipping the output, but it still completely crashes, but I will keep on trying and let you know if something works.

user136984

@Stunts: The output of that command without the strings bit is: /bin/cat, and the ls of that folder is:

user136984

appletviewer javafxpackager jdb jrunscript pack200 unpack200
ControlPanel javah jdeps jsadebugd policytool wsgen
extcheck javap jhat jstack rmic wsimport
idlj javapackager jinfo jstat rmid xjc
jar java-rmi.cgi jjs jstatd rmiregistry
jarsigner javaws jmap jvisualvm schemagen
java jcmd jmc keytool serialver
javac jconsole jmc.ini native2ascii servertool

Stunts

8:43 PM

That is odd indeed. The location in your local $PATH seems clear.

Can you try to do /bin/cat some_file.txt ?

Transcript for

Discussion on question by Paranoid Pa…