Strange script planted with Bash 2
More than four months later, similar issue, although not looking that perilous, apparently (but I'm not an expert), in Devuan.
Pls. see more, including maybe (at least some) explanation, or new links to where expert knowledge may explain it..., at:
Strange Bash under grsecurity's exec logging
It's 46 seconds. You want it even more quickly? Then, but watch carefully, and trust me that the little logging deluge in the /var/log/kern.log (which was in that terminal in bottom under the grip of and just had to be talking in real time :-) by the command tail -f /var/log/kern.log) was started by my only pressing Tab at that point on that unfinished command make menucon: the screencast (link to open in a separate tab or window from 25 seconds from start). And regularly posting it is:
The screencast is there to corroborate my somewhat hard-to-believe claims... Please look at all the executables dancing just after I pressed Tab (which you don't see that I did, but I take you can trust my words that much :) ...). The exec dance is all in:
kern.log_170918_064755_gdOv0-2
Anybody got any clear idea what that is?
Again, for more, including possibly some explanation, or possibly new links to where expert knowledge may shed light on it, if there should hopefully be more development on this, see:
Strange Bash under grsecurity's exec logging
---
The files (possibly, more below) necessary for this study are listed in: ls-1pg2
Screen_170918_0646_gdO.webm kern.log_170918_064755_gdOv0-2 kern.log_170918_064755_gdOv0.gg
I removed two lines (oh, with nothing too important, but still...) from the kern.log_170918_064755_gdOv0 as hash-posted on Strange Bash under grsecurity's exec logging (the opening page, posted a few hours ago, but only a quarter of an hour ago after the screencast and the log happened), so while I keep the encrypted to myself kern.log_170918_064755_gdOv0.gg without you being able to decrypt it (but the hash precludes any tempering of it for anybody, including me... well, unless SHA256 gets broken or my key stolen...), all but the two lines --which are not related to the matter, but to SSL-logging-- is still in the kern.log_170918_064755_gdOv0-2 (the -2 standing for 2 lines missing).
and verify to: ls-1pg2.sum signed by: ls-1pg2.sum.asc
