(solved)Bad bash script

[GarryRicketson]

I have someone asking me about this on the spanish forum,
Ataque DoS, question

In a nut shell, a user , experimenting , started this script:

Code: Select all

 #!/bin/bash
# Ping multiple destinations at once
args=$#
interval=$1
shift;
pktsize=$1
shift;
for (( i=3; i<=$args; i++ )); do
        ping -i $interval -s $pktsize $1 > /dev/null &
        shift;
done

I do not know enough about bash scripts to even know what it does,
However, DO NOT run it, the problem it has caused is they can not stop
it, even killing the process, apparently, it starts up again even after re-booting
the server,
some additional info:

Code: Select all

 ps -ef | grep pingIP | grep -v 'grep pingIP'
lausan     3317  2649  0 10:23 pts/0    00:00:00 grep --color=auto pingIP
lausan     3318  2649  0 10:23 pts/0    00:00:00 grep --color=auto pingIP

and

Code: Select all

 pkill pingIP

I have told the person to try using
'top' and see what the P id number is, and instead of
"pkill"

Code: Select all

 kill "pid number"

Any way , if anyone has some ideas, any feed back or suggestion is
appreciated, and thanks.
P.S. I am also trying to do some searches, to see what more
I can find,

[bw123]

Any way , if anyone has some ideas, any feed back or suggestion is
appreciated, and thanks.

Tell the punk that DoS ain't funny, and grow up?

[GarryRicketson]

Well, yes, I mean no it is not funny, But how to stop the script forever ?

[bw123]

sheesh... these kids nowadays, how about this?

# rm pingIP

[GarryRicketson]

OK thanks

[csystem]

All that that script appears to do is ping a bunch of host at the same time with the same interval and packet size
e.g. $bash pingIP.sh 1 56 192.168.1.1 google.com
Then it will send a 56 byte size packet to 192.168.1.1 and google.com every second indefinitely.
Yes, it can be used as a ddos by setting the packet size very high and the interval very low.

But your script is not running forever. It just stats as many ping commands as you have agruments and stops.
After a reboot, this will most definitely stop.

Code: Select all

 ps -ef | grep pingIP | grep -v 'grep pingIP'
lausan     3317  2649  0 10:23 pts/0    00:00:00 grep --color=auto pingIP
lausan     3318  2649  0 10:23 pts/0    00:00:00 grep --color=auto pingIP

Check the actual process you are seeing here: "grep --color=auto pingIP"
You are just seeing the grep process that is obviously running as you just started it.

Just check your running processes using htop and press f4 to filter the results

[GarryRicketson]

Thanks for explaining it more, this was so long ago, and I had forgotten
to mark it solved, but anyway the explanation will help others understand
it better.
Thanks