> But few are in the practice of doing that.

Because there's no point. If I'm able to manipulate your shell environment to set aliases, I can also change your search path so that \sudo picks up the program I want. And no, you can't defeat that by only running /usr/bin/sudo because there are a million other nasty things to do once an attacker has reached this level of control.

I'm sure there are plenty of tricks. I could be wrong, but I think the \ is a shell builtin thing, so I don't think creating a \sudo or the like would work. You could set the PATH and put a fake sudo in a secret directory in there that precedes the /usr/bin/sudo though, so that would be a problem.

untested, but I think you could possibly bypass it with a malicious .inputrc binding for <enter>, although making it conditional such that it only removed a leading \ could be tricky.

In Bash there might also be a way to do something cunning with a 'trap DEBUG' hook to modify the command between submission and it actually being run.

Or you could just exec into a terminal multiplexer like screen[1] to intercept & rewrite/suppress both commands and output.

Edit: It's much easier than that.

The function:

    echo () { command echo "hax" $@; }

will still be called by '\echo test' (The 'command' prefix stops it becoming a forkbomb :)

[1] or maybe just hijack stdin/out FDs from the shell?

Would it?

If the attacker was able to backdoor the system, isn't also possible they could install a modified shell that no-ops \?

Isn't the login shell set in /etc/passwd? So you would need root to either modify that, or to overwrite the shell binary.

Didn't know that! Thanks.