On Mon, Nov 14, 2022 at 4:21 AM Greg Wooledge <g...@wooledge.org> wrote:
> On Sun, Nov 13, 2022 at 09:05:03PM -0600, David Wright wrote: > > On Sun 13 Nov 2022 at 14:50:58 (+0000), Andrew M.A. Cater wrote: > > > On Sun, Nov 13, 2022 at 06:04:51AM -0800, pe...@easthope.ca wrote: > > > > root@joule:/home/root# /bin/ping -c 3 192.168.0.12 > > > > PING 192.168.0.12 (192.168.0.12) 56(84) bytes of data. > > > > 64 bytes from 192.168.0.12: icmp_seq=1 ttl=64 time=0.079 ms > > > > 64 bytes from 192.168.0.12: icmp_seq=2 ttl=64 time=0.114 ms > > > > 64 bytes from 192.168.0.12: icmp_seq=3 ttl=64 time=0.113 ms > > > > > > > > --- 192.168.0.12 ping statistics --- > > > > 3 packets transmitted, 3 received, 0% packet loss, time 2041ms > > > > rtt min/avg/max/mdev = 0.079/0.102/0.114/0.016 ms > > > > root@joule:/home/root# echo $PATH > > > > /usr/local/bin:/usr/local/sbin:/usr/bin:/usr/sbin:/bin:/sbin:. > > > > Nobody has commented on that final period yet … … … … … … ↑ > > I didn't see it. Yeah, that's *nasty*. I don't think it's directly > related to whatever the OP's current problem is, but it's a trap waiting > to strike. > > The OP is clearly not running a standard Debian system. With root's > home directory having been moved, and now with some evidence that the > PATH given to root has a massive security hole in it, I'm convinced > this is some derivative OS. > > Perhaps whoever put the ":." on root's PATH is also responsible for > the alias or function that's overriding "ping". I'm starting to get > rather curious about this whole situation. > > Yes, this user runs as root all the time, from previous threads: https://lists.debian.org/debian-user/2022/02/msg00041.html
